Kibana Security AI Assistant API API
Manage and interact with Security Assistant resources.
OpenAPI Specification
openapi: 3.0.3
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana APIs Actions Security AI Assistant API API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: Manage and interact with Security Assistant resources.
name: Security AI Assistant API
x-displayName: Security AI assistant
paths:
/api/security_ai_assistant/anonymization_fields/_bulk_action:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/security_ai_assistant/anonymization_fields/_bulk_action</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Apply a bulk action to multiple anonymization fields. The bulk action is applied to all anonymization fields that match the filter or to the list of anonymization fields by their IDs.'
operationId: PerformAnonymizationFieldsBulkAction
requestBody:
content:
application/json:
examples:
PerformAnonymizationFieldsBulkActionRequest:
value:
create:
- allowed: true
anonymized: false
field: host.name
- allowed: false
anonymized: true
field: user.name
delete:
ids:
- field5
- field6
query: 'field: host.name'
update:
- allowed: true
anonymized: false
id: field8
- allowed: false
anonymized: true
id: field9
schema:
example:
create:
- allowed: true
anonymized: false
field: host.name
- allowed: false
anonymized: true
field: user.name
delete:
ids:
- field5
- field6
query: 'field: host.name'
update:
- allowed: true
anonymized: false
id: field8
- allowed: false
anonymized: true
id: field9
type: object
properties:
create:
description: Array of anonymization fields to create.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldCreateProps'
type: array
delete:
description: Object containing the query to filter anonymization fields and/or an array of anonymization field IDs to delete.
type: object
properties:
ids:
description: Array of IDs to apply the action to.
example:
- '1234'
- '5678'
items:
type: string
minItems: 1
type: array
query:
description: Query to filter the bulk action.
example: 'status: ''inactive'''
type: string
update:
description: Array of anonymization fields to update.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldUpdateProps'
type: array
responses:
'200':
content:
application/json:
examples:
PerformAnonymizationFieldsBulkActionResponse200Example:
value:
anonymization_fields_count: 4
attributes:
results:
created:
- allowed: false
anonymized: true
createdAt: '2023-10-31T12:00:00Z'
createdBy: user1
field: host.name
id: field2
namespace: default
timestamp: '2023-10-31T12:00:00Z'
updatedAt: '2023-10-31T12:00:00Z'
updatedBy: user1
deleted:
- field3
skipped:
- id: field4
name: user.name
skip_reason: ANONYMIZATION_FIELD_NOT_MODIFIED
updated:
- allowed: true
anonymized: false
createdAt: '2023-10-31T12:00:00Z'
createdBy: user1
field: url.domain
id: field8
namespace: default
timestamp: '2023-10-31T12:00:00Z'
updatedAt: '2023-10-31T12:00:00Z'
updatedBy: user1
summary:
failed: 0
skipped: 1
succeeded: 3
total: 4
message: Bulk action completed successfully
status_code: 200
success: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse'
description: Indicates a successful call.
'400':
content:
application/json:
examples:
PerformAnonymizationFieldsBulkActionResponse400Example:
value:
error: Bad Request
message: Invalid request body
statusCode: 400
schema:
type: object
properties:
error:
description: Error type or name.
type: string
message:
description: Detailed error message.
type: string
statusCode:
description: Status code of the response.
type: number
description: Bad Request response.
summary: Apply a bulk action to anonymization fields
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/anonymization_fields/_bulk_action' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"create\":[{\"field\":\"host.name\",\"allowed\":true,\"anonymized\":false}]}'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/anonymization_fields/_find:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/security_ai_assistant/anonymization_fields/_find</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of all anonymization fields.'
operationId: FindAnonymizationFields
parameters:
- description: Fields to return
example:
- id
- field
- anonymized
- allowed
in: query
name: fields
required: false
schema:
items:
type: string
type: array
- description: Search query
example: 'field: "user.name"'
in: query
name: filter
required: false
schema:
type: string
- description: Field to sort by
example: created_at
in: query
name: sort_field
required: false
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_FindAnonymizationFieldsSortField'
- description: Sort order
example: asc
in: query
name: sort_order
required: false
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
- description: Page number
example: 1
in: query
name: page
required: false
schema:
default: 1
minimum: 1
type: integer
- description: AnonymizationFields per page
example: 20
in: query
name: per_page
required: false
schema:
default: 20
minimum: 0
type: integer
- description: If true, additionally fetch all anonymization fields, otherwise fetch only the provided page
in: query
name: all_data
required: false
schema:
type: boolean
responses:
'200':
content:
application/json:
examples:
FindAnonymizationFieldsResponse200Example:
value:
aggregations:
field_status:
buckets:
allowed:
doc_count: 1
anonymized:
doc_count: 1
denied:
doc_count: 1
all:
- allowed: true
anonymized: true
createdAt: '2023-10-31T12:00:00Z'
createdBy: user1
field: user.name
id: '1'
namespace: default
timestamp: '2023-10-31T12:00:00Z'
updatedAt: '2023-10-31T12:00:00Z'
updatedBy: user1
data:
- allowed: true
anonymized: true
createdAt: '2023-10-31T12:00:00Z'
createdBy: user1
field: user.name
id: '1'
namespace: default
timestamp: '2023-10-31T12:00:00Z'
updatedAt: '2023-10-31T12:00:00Z'
updatedBy: user1
page: 1
perPage: 20
total: 100
schema:
type: object
properties:
aggregations:
type: object
properties:
field_status:
type: object
properties:
buckets:
type: object
properties:
allowed:
type: object
properties:
doc_count:
default: 0
type: integer
anonymized:
type: object
properties:
doc_count:
default: 0
type: integer
denied:
type: object
properties:
doc_count:
default: 0
type: integer
all:
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
type: array
data:
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
type: array
page:
type: integer
perPage:
type: integer
total:
type: integer
required:
- page
- perPage
- total
- data
description: Indicates a successful call.
'400':
content:
application/json:
examples:
FindAnonymizationFieldsResponse400Example:
value:
error: Bad Request
message: Invalid request parameters
statusCode: 400
schema:
type: object
properties:
error:
type: string
message:
type: string
statusCode:
type: number
description: Bad Request response.
summary: Get anonymization fields
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/anonymization_fields/_find?page=1&per_page=20' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/chat/complete:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/security_ai_assistant/chat/complete</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a model response for the given chat conversation.'
operationId: ChatComplete
parameters:
- description: If true, the response will not include content references.
example: false
in: query
name: content_references_disabled
required: false
schema:
default: false
type: boolean
requestBody:
content:
application/json:
examples:
ChatCompleteRequest:
value:
connectorId: conn-001
conversationId: abc123
isStream: true
langSmithApiKey: <LANGSMITH_API_KEY>
langSmithProject: security_ai_project
messages:
- content: What are some common phishing techniques?
data:
user_id: user_789
fields_to_anonymize:
- user.name
- source.ip
role: user
model: gpt-4
persist: true
promptId: prompt_456
responseLanguage: en
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ChatCompleteProps'
required: true
responses:
'200':
content:
application/octet-stream:
examples:
ChatCompleteResponse200Example:
value: (streaming binary response)
schema:
format: binary
type: string
description: Indicates a successful model response call.
'400':
content:
application/json:
examples:
ChatCompleteResponse400Example:
value:
error: Bad Request
message: Invalid request payload.
statusCode: 400
schema:
type: object
properties:
error:
description: Error type.
example: Bad Request
type: string
message:
description: Human-readable error message.
example: Invalid request payload.
type: string
statusCode:
description: HTTP status code.
example: 400
type: number
description: Bad Request response.
summary: Create a model response
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/chat/complete' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"connectorId\":\"conn-001\",\"persist\":true,\"messages\":[{\"role\":\"user\",\"content\":\"What are common phishing techniques?\"}]}'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/current_user/conversations:
delete:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/security_ai_assistant/current_user/conversations</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
This endpoint allows users to permanently delete all conversations.'
operationId: DeleteAllConversations
requestBody:
content:
application/json:
examples:
DeleteAllConversationsRequest:
value:
excludedIds:
- abc123
- def456
schema:
type: object
properties:
excludedIds:
description: Optional list of conversation IDs to delete.
example:
- abc123
- def456
items:
type: string
type: array
required: false
responses:
'200':
content:
application/json:
examples:
DeleteAllConversationsResponse200Example:
value:
failures: []
success: true
totalDeleted: 10
schema:
type: object
properties:
failures:
items:
type: string
type: array
success:
example: true
type: boolean
totalDeleted:
example: 10
type: number
description: Indicates a successful call. The conversations were deleted successfully.
'400':
content:
application/json:
examples:
DeleteAllConversationsResponse400Example:
value:
error: Bad Request
message: Invalid conversation ID
statusCode: 400
schema:
type: object
properties:
error:
example: Bad Request
type: string
message:
example: Invalid conversation ID
type: string
statusCode:
example: 400
type: number
description: Bad Request response.
summary: Delete conversations
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request DELETE 'http://localhost:5601/api/security_ai_assistant/current_user/conversations' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"excludedIds\":[\"abc123\"]}'\n"
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/security_ai_assistant/current_user/conversations</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a new Security AI Assistant conversation. This endpoint allows the user to initiate a conversation with the Security AI Assistant by providing the required parameters.'
operationId: CreateConversation
requestBody:
content:
application/json:
examples:
CreateConversationRequest:
value:
apiConfig:
actionTypeId: '67890'
connectorId: '12345'
category: assistant
excludeFromLastConversationStorage: false
messages:
- content: Hello, how can I assist you today?
role: system
timestamp: '2023-10-31T12:00:00Z'
replacements: {}
title: Security Discussion
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCreateProps'
required: true
responses:
'200':
content:
application/json:
examples:
CreateConversationResponse200Example:
value:
apiConfig:
actionTypeId: '67890'
connectorId: '12345'
category: assistant
createdAt: '2023-10-31T12:01:00Z'
createdBy:
id: user1
name: John Doe
excludeFromLastConversationStorage: false
id: abc123
messages:
- content: Hello, how can I assist you today?
role: system
timestamp: '2023-10-31T12:00:00Z'
namespace: default
replacements: {}
title: Security Discussion
updatedAt: '2023-10-31T12:01:00Z'
users:
- id: user1
name: John Doe
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
description: Indicates a successful call. The conversation was created successfully.
'400':
content:
application/json:
examples:
CreateConversationResponse400Example:
value:
error: Bad Request
message: 'Missing required parameter: title'
statusCode: 400
schema:
type: object
properties:
error:
example: Bad Request
type: string
message:
example: 'Missing required parameter: title'
type: string
statusCode:
example: 400
type: number
description: Bad Request response.
summary: Create a conversation
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/current_user/conversations' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"title\":\"Security Discussion\",\"category\":\"assistant\",\"messages\":[{\"content\":\"Hello\",\"role\":\"system\",\"timestamp\":\"2023-10-31T12:00:00Z\"}],\"apiConfig\":{\"connectorId\":\"12345\",\"actionTypeId\":\"67890\"},\"replacements\":{},\"excludeFromLastConversationStorage\":false}'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/current_user/conversations/_find:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/security_ai_assistant/current_user/conversations/_find</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of all conversations for the current user. This endpoint allows users to search, filter, sort, and paginate through their conversations.'
operationId: FindConversations
parameters:
- description: A list of fields to include in the response. If omitted, all fields are returned.
in: query
name: fields
required: false
schema:
example:
- id
- title
- createdAt
items:
type: string
type: array
- description: A search query to filter the conversations. Can match against titles, messages, or other conversation attributes.
in: query
name: filter
required: false
schema:
example: Security Issue
type: string
- description: The field by which to sort the results. Valid fields are `created_at`, `title`, and `updated_at`.
in: query
name: sort_field
required: false
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_FindConversationsSortField'
example: created_at
- description: The order in which to sort the results. Can be either `asc` for ascending or `desc` for descending.
in: query
name: sort_order
required: false
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
example: desc
- description: The page number of the results to retrieve. Default is 1.
in: query
name: page
required: false
schema:
default: 1
example: 1
minimum: 1
type: integer
- description: The number of conversations to return per page. Default is 20.
in: query
name: per_page
required: false
schema:
default: 20
example: 20
minimum: 0
type: integer
- description: Whether to return conversations that the current user owns. If true, only conversations owned by the user are returned.
in: query
name: is_owner
required: false
schema:
default: false
example: true
type: boolean
responses:
'200':
content:
application/json:
examples:
FindConversationsResponse200Example:
value:
data:
- category: assistant
createdAt: '2023-10-31T12:00:00Z'
createdBy:
id: user1
name: John Doe
excludeFromLastConversationStorage: false
id: conv-abc123
messages: []
namespace: default
replacements: {}
title: Security Discussion
updatedAt: '2023-10-31T12:05:00Z'
users:
- id: user1
name: John Doe
page: 1
perPage: 20
total: 5
schema:
type: object
properties:
data:
description: A list of conversations.
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
type: array
page:
description: The current page of the results.
example: 1
type: integer
perPage:
description: The number of results returned per page.
example: 20
type: integer
total:
description: The total number of conversations matching the filter criteria.
example: 100
type: integer
required:
- page
- perPage
- total
- data
description: Successful response, returns a paginated list of conversations matching the specified criteria.
'400':
content:
application/json:
examples:
FindConversationsResponse400Example:
value:
error: Bad Request
message: Invalid filter parameter.
statusCode: 400
schema:
type: object
properties:
error:
example: Bad Request
type: string
message:
example: Invalid filter query parameter
type: string
statusCode:
example: 400
type: number
description: Bad Request response.
summary: Get conversations
tags:
- Security AI Assistant API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/_find?page=1&per_page=20' \\\n --header \"Authorization: $API_KEY\"\n"
x-metaTags:
- content: Kibana
name: product_name
/api/security_ai_assistant/current_user/conversations/{id}:
delete:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Delete an existing conversa
# --- truncated at 32 KB (149 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-security-ai-assistant-api-api-openapi.yml