# Kibana Security Lists API API

**Canonical:** https://apis.io/apis/kibana/kibana-security-lists-api-api/  
**Provider:** Kibana — https://apis.io/providers/kibana/  
**Base URL:** https://localhost:5601/api  
**Documentation:** https://www.elastic.co/guide/en/kibana/current/api.html

Kibana Security Lists API API is one of 60 APIs that [Kibana](https://apis.io/providers/kibana/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Security Lists API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.

Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts. Lists are made up of: * **List containers**: A container for values of the same Elasticsearch data type. The following data types can be used: * `boolean` * `byte` * `date` * `date_nanos` * `date_range` * `double` * `double_range` * `float` * `float_range` * `half_float` * `integer` * `integer_range` * `ip` * `ip_range` * `keyword` * `long` * `long_range` * `short` * `text` * **List items**: The values used to determine whether the exception prevents an alert from being generated. All list items in the same list container must be of the same data type, and each item defines a single value. For example, an IP list container named `internal-ip-addresses-southport` contains five items, where each item defines one internal IP address: 1. `192.168.1.1` 2. `192.168.1.3` 3. `192.168.1.18` 4. `192.168.1.12` 5. `192.168.1.7` To use these IP addresses as values for defining rule exceptions, use the Security exceptions API to [create an exception list item](../operation/operation-createexceptionlistitem) that references the `internal-ip-addresses-southport` list. > info > Lists cannot be added directly to rules, nor do they define the operators used to determine when exceptions are applied (`is in list`, `is not in list`). Use an exception item to define the operator and associate it with an [exception container](../operation/operation-createexceptionlist). You can then add the exception container to a rule's `exceptions_list` object. ## Lists requirements Before you can start using lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. Refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) for a complete list of requirements.

## Machine-readable artifacts (3)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-security-lists-api-api-openapi.yml
- **Documentation** — https://www.elastic.co/guide/en/kibana/current/api.html
- **Authentication** — https://www.elastic.co/guide/en/kibana/current/api-authentication.html

## Other Kibana APIs (12)

- [Kibana Actions API](https://apis.io/apis/kibana/kibana-actions-api/)
- [Kibana agent builder API](https://apis.io/apis/kibana/kibana-agent-builder-api/)
- [Kibana alerting API](https://apis.io/apis/kibana/kibana-alerting-api/)
- [Kibana APM agent configuration API](https://apis.io/apis/kibana/kibana-apm-agent-configuration-api/)
- [Kibana APM agent keys API](https://apis.io/apis/kibana/kibana-apm-agent-keys-api/)
- [Kibana APM annotations API](https://apis.io/apis/kibana/kibana-apm-annotations-api/)
- [Kibana APM server schema API](https://apis.io/apis/kibana/kibana-apm-server-schema-api/)
- [Kibana APM sourcemaps API](https://apis.io/apis/kibana/kibana-apm-sourcemaps-api/)
- [Kibana cases API](https://apis.io/apis/kibana/kibana-cases-api/)
- [Kibana connectors API](https://apis.io/apis/kibana/kibana-connectors-api/)
- [Kibana Data streams API](https://apis.io/apis/kibana/kibana-data-streams-api/)
- [Kibana data views API](https://apis.io/apis/kibana/kibana-data-views-api/)

## Tags

Security Lists API

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/kibana/kibana-security-lists-api-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/kibana/.