1. Docs /
  2. APIs /
  3. Kibana API v8

Elastic Agent policies

Elastic Agent policies APIs enable you to manage agent policies, including creating, updating, and deleting policies, as well as to retrieve agent policy outputs, manifests, and auto-upgrade status information.

  • List agent policies
    • GET /api/fleet/agent_policies
  • Create agent policy
    • POST /api/fleet/agent_policies
  • Bulk get agent policies
    • POST /api/fleet/agent_policies/_bulk_get
  • Delete agent policy by ID
    • POST /api/fleet/agent_policies/delete
  • Get agent policy by ID
    • GET /api/fleet/agent_policies/{agentPolicyId}
  • Update agent policy by ID
    • PUT /api/fleet/agent_policies/{agentPolicyId}
  • Copy agent policy by ID
    • POST /api/fleet/agent_policies/{agentPolicyId}/copy
  • Download agent policy by ID
    • GET /api/fleet/agent_policies/{agentPolicyId}/download
  • Get full agent policy by ID
    • GET /api/fleet/agent_policies/{agentPolicyId}/full
View as Markdown
Download OpenAPI spec (JSON) Download OpenAPI spec (YAML)
Version
main v9 (latest) v8 v0
Elastic Stack
Elasticsearch API Elasticsearch Serverless API Kibana API Kibana Serverless API Logstash API
Orchestration
Elastic Cloud API Cloud Billing API Elastic Cloud Connected API Elastic Cloud Enterprise API Elastic Cloud Serverless API
All APIs
  • Topics
    • Authentication
    • Spaces

  • Alerting
    • Get the alerting framework health GET
    • Get rule details GET
    • Create a rule POST
    • Update a rule PUT
    • Delete a rule DELETE
    • Disable a rule POST
    • Enable a rule POST
    • Mute all alerts POST
    • Unmute all alerts POST
    • Update the API key for a rule POST
    • Schedule a snooze for the rule POST
    • Delete a snooze schedule for a rule DELETE
    • Mute an alert POST
    • Unmute an alert POST
    • Get the rule types GET
    • Get information about rules GET
    • Get an alert by identifier Deprecated GET
    • Create an alert Deprecated POST
    • Update an alert Deprecated PUT
    • Delete an alert Deprecated DELETE
    • Disable an alert Deprecated POST
    • Enable an alert Deprecated POST
    • Mute all alert instances Deprecated POST
    • Unmute all alert instances Deprecated POST
    • Mute an alert instance Deprecated POST
    • Unmute an alert instance Deprecated POST
    • Get a paginated set of alerts Deprecated GET
    • Get the alerting framework health Deprecated GET
    • Get the alert types Deprecated GET
  • APM agent configuration
    • Get a list of agent configurations GET
    • Create or update agent configuration PUT
    • Delete agent configuration DELETE
    • Get agent name for service GET
    • Get environments for service GET
    • Lookup single agent configuration POST
    • Get single agent configuration GET
  • APM agent keys
    • Create an APM agent key POST
  • APM annotations
    • Create a service annotation POST
    • Search for annotations GET
  • APM server schema
    • Save APM server schema POST
  • APM sourcemaps
    • Get source maps GET
    • Upload source map POST
    • Delete source map DELETE
  • Cases
    • Create a case POST
    • Update cases PATCH
    • Delete cases DELETE
    • Search cases GET
    • Get cases for an alert GET
    • Get case settings GET
    • Add case settings POST
    • Get case connectors GET
    • Update case settings PATCH
    • Get case creators GET
    • Get case status summary Deprecated GET
    • Get case tags GET
    • Get case information GET
    • Get all alerts for a case GET
    • Get all case comments Deprecated GET
    • Add a case comment or alert POST
    • Update a case comment or alert PATCH
    • Delete all case comments and alerts DELETE
    • Find case comments and alerts GET
    • Get a case comment or alert GET
    • Delete a case comment or alert DELETE
    • Push a case to an external service POST
    • Attach a file to a case POST
    • Get case activity Deprecated GET
    • Find case activity GET
  • Connectors
    • Get all connectors Deprecated GET
    • Create a connector Deprecated POST
    • Get connector information Deprecated GET
    • Update a connector Deprecated PUT
    • Delete a connector Deprecated DELETE
    • Run a connector Deprecated POST
    • Get connector information GET
    • Create a connector POST
    • Update a connector PUT
    • Delete a connector DELETE
    • Run a connector POST
    • Get connector types GET
    • Get all connectors GET
    • Get connector types Deprecated GET
  • Data streams
    • List data streams GET
  • Data views
    • Get all data views GET
    • Create a data view POST
    • Get a data view GET
    • Update a data view POST
    • Delete a data view DELETE
    • Update data view fields metadata POST
    • Create a runtime field POST
    • Create or update a runtime field PUT
    • Get a runtime field GET
    • Update a runtime field POST
    • Delete a runtime field from a data view DELETE
    • Get the default data view GET
    • Set the default data view POST
    • Swap saved object references POST
    • Preview a saved object reference swap POST
  • Elastic Agent actions
    • Get agent action status GET
    • Cancel agent action POST
    • Create agent action POST
  • Elastic Agent binary download sources
    • List agent binary download sources GET
    • Create agent binary download source POST
    • Get agent binary download source by ID GET
    • Update agent binary download source by ID PUT
    • Delete agent binary download source by ID DELETE
  • Elastic Agent policies
    • List agent policies GET
    • Create agent policy POST
    • Bulk get agent policies POST
    • Delete agent policy by ID POST
    • Get agent policy by ID GET
    • Update agent policy by ID PUT
    • Copy agent policy by ID POST
    • Download agent policy by ID GET
    • Get full agent policy by ID GET
  • Elastic Agent status
    • Get agent status summary Deprecated GET
    • Get agent status summary GET
    • Get incoming agent data GET
  • Elastic Agents
    • List agents GET
    • List agents by action ids POST
    • Bulk reassign agents POST
    • Bulk request diagnostics from agents POST
    • Bulk unenroll agents POST
    • Bulk update agent tags POST
    • Bulk upgrade agents POST
    • Delete file uploaded by agent DELETE
    • Get file uploaded by agent GET
    • Get agent setup info GET
    • Initiate agent setup POST
    • List agent tags GET
    • Get agent by ID GET
    • Update agent by ID PUT
    • Delete agent by ID DELETE
    • Reassign agent POST
    • Reassign agent Deprecated PUT
    • Request agent diagnostics POST
    • Unenroll agent POST
    • Upgrade agent POST
    • List agent uploads GET
  • Elastic Package Manager (EPM)
    • Bulk get assets POST
    • List package categories GET
    • List packages GET
    • Install by package by direct upload POST
    • Bulk install packages POST
    • Get limited package list GET
    • Get package stats GET
    • Get package GET
    • Install package POST
    • Update package settings PUT
    • Delete package DELETE
    • Authorize transforms POST
    • Get package file GET
    • Get package Deprecated GET
    • Install package Deprecated POST
    • Delete ackage Deprecated DELETE
    • Get inputs template GET
    • Get package signature verification key ID GET
  • Fleet enrollment API keys
    • List enrollment API keys Deprecated GET
    • Create enrollment API key Deprecated POST
    • Get enrollment API key by ID Deprecated GET
    • Delete enrollment API key by ID Deprecated DELETE
    • List enrollment API keys GET
    • Create enrollment API key POST
    • Get enrollment API key by ID GET
    • Revoke enrollment API key by ID by marking it as inactive DELETE
  • Fleet internals
    • Fleet Server health check POST
    • Get settings GET
    • Update settings PUT
    • Initiate Fleet setup POST
  • Fleet Kubernetes
    • Get full K8s agent manifest GET
  • Fleet outputs
    • Generate Logstash API key POST
    • List outputs GET
    • Create output POST
    • Get output by ID GET
    • Update output by ID PUT
    • Delete output by ID DELETE
    • Get latest output health GET
  • Fleet package policies
    • List package policies GET
    • Create package policy POST
    • Bulk get package policies POST
    • Delete package policy POST
    • Upgrade package policy to a newer package version POST
    • Dry run package policy upgrade POST
    • Get package policy by ID GET
    • Update package policy by ID PUT
    • Delete package policy by ID DELETE
  • Fleet proxies
    • List proxies GET
    • Create proxy POST
    • Get proxy by ID GET
    • Update proxy by ID PUT
    • Delete proxy by ID DELETE
  • Fleet Server hosts
    • List Fleet Server hosts GET
    • Create Fleet Server host POST
    • Get Fleet Server host by ID GET
    • Update Fleet Server host by ID PUT
    • Delete Fleet Server host by ID DELETE
  • Fleet service tokens
    • Create service token Deprecated POST
    • Create service token POST
  • Fleet uninstall tokens
    • List metadata for latest uninstall tokens per agent policy GET
    • Get one decrypted uninstall token by its ID GET
  • Logstash configuration management
    • Get a Logstash pipeline GET
    • Create or update a Logstash pipeline PUT
    • Delete a Logstash pipeline DELETE
    • Get all Logstash pipelines GET
  • Machine learning
    • Sync saved objects in the default space GET
  • Maintenance windows
    • Create a maintenance window. POST
    • Get maintenance window details. GET
    • Update a maintenance window. PATCH
    • Delete a maintenance window. DELETE
    • Archive a maintenance window. POST
    • Unarchive a maintenance window. POST
  • Roles
    • Get all roles GET
    • Get a role GET
    • Create or update a role PUT
    • Delete a role DELETE
    • Create or update roles POST
  • Saved objects
    • Rotate a key for encrypted saved objects POST
    • Create saved objects Deprecated POST
    • Delete saved objects Deprecated POST
    • Get saved objects Deprecated POST
    • Resolve saved objects Deprecated POST
    • Update saved objects Deprecated POST
    • Export saved objects POST
    • Search for saved objects Deprecated GET
    • Import saved objects POST
    • Resolve import errors POST
    • Resolve a saved object Deprecated GET
    • Create a saved object Deprecated POST
    • Get a saved object Deprecated GET
    • Create a saved object Deprecated POST
    • Update a saved object Deprecated PUT
  • Security AI assistant
    • Apply a bulk action to anonymization fields POST
    • Get anonymization fields GET
    • Create a model response POST
    • Create a conversation POST
    • Delete conversations DELETE
    • Get conversations GET
    • Get a conversation GET
    • Update a conversation PUT
    • Delete a conversation DELETE
    • Create a Knowledge Base Entry POST
    • Applies a bulk action to multiple Knowledge Base Entries POST
    • Finds Knowledge Base Entries that match the given query. GET
    • Read a Knowledge Base Entry GET
    • Update a Knowledge Base Entry PUT
    • Deletes a single Knowledge Base Entry using the `id` field DELETE
    • Read a KnowledgeBase GET
    • Create a KnowledgeBase POST
    • Apply a bulk action to prompts POST
    • Get prompts GET
  • Security detections
    • Reads the alert index name if it exists GET
    • Create an alerts index POST
    • Delete an alerts index DELETE
    • Returns user privileges for the Kibana space GET
    • Retrieve a detection rule GET
    • Create a detection rule POST
    • Update a detection rule PUT
    • Patch a detection rule PATCH
    • Delete a detection rule DELETE
    • Apply a bulk action to detection rules POST
    • Create multiple detection rules Deprecated POST
    • Delete multiple detection rules Deprecated POST
    • Update multiple detection rules Deprecated PUT
    • Patch multiple detection rules Deprecated PATCH
    • Export detection rules POST
    • List all detection rules GET
    • Import detection rules POST
    • Install prebuilt detection rules and Timelines PUT
    • Retrieve the status of prebuilt detection rules and Timelines GET
    • Preview rule alerts generated on specified time range POST
    • Assign and unassign users from detection alerts POST
    • Finalize detection alert migrations Deprecated POST
    • Initiate a detection alert migration Deprecated POST
    • Clean up detection alert migrations Deprecated DELETE
    • Retrieve the status of detection alert migrations Deprecated POST
    • Find and/or aggregate detection alerts POST
    • Set a detection alert status POST
    • Add and remove detection alert tags POST
    • List all detection rule tags GET
  • Security Elastic Endpoint exceptions
    • Create an Elastic Endpoint rule exception list POST
    • Get an Elastic Endpoint rule exception list item GET
    • Create an Elastic Endpoint rule exception list item POST
    • Update an Elastic Endpoint rule exception list item PUT
    • Delete an Elastic Endpoint exception list item DELETE
    • Get Elastic Endpoint exception list items GET
  • Security endpoint management
    • Get response actions GET
    • Run a command POST
    • Get a file POST
    • Isolate an endpoint POST
    • Terminate a process POST
    • Get running processes POST
    • Run a script POST
    • Scan a file or directory POST
    • Get actions state GET
    • Suspend a process POST
    • Release an isolated endpoint POST
    • Upload a file POST
    • Get action details GET
    • Get file information GET
    • Download a file GET
    • Get an action request log Deprecated GET
    • Get response actions status GET
    • Isolate an endpoint Deprecated POST
    • Get a metadata list GET
    • Get metadata transforms Deprecated GET
    • Get metadata GET
    • Get an agent policy summary Deprecated GET
    • Get a policy response GET
    • Get a protection updates note GET
    • Create or update a protection updates note POST
    • Get suggestions Deprecated POST
    • Release an isolated endpoint Deprecated POST
  • Security entity analytics
    • Get an asset criticality record GET
    • Upsert an asset criticality record POST
    • Delete an asset criticality record DELETE
    • Bulk upsert asset criticality records POST
    • List asset criticality records GET
    • Initialize the Entity Store POST
    • List the Entity Engines GET
    • Apply DataView indices to all installed engines POST
    • Get an Entity Engine GET
    • Delete the Entity Engine DELETE
    • Initialize an Entity Engine POST
    • Start an Entity Engine POST
    • Stop an Entity Engine POST
    • List Entity Store Entities GET
    • Get the status of the Entity Store GET
    • Cleanup the Risk Engine DELETE
    • Configure the Risk Engine Saved Object PATCH
    • Run the risk scoring engine POST
  • Security exceptions
    • Exceptions requirements
    • Create rule exception list items POST
    • Get exception list details GET
    • Create an exception list POST
    • Update an exception list PUT
    • Delete an exception list DELETE
    • Duplicate an exception list POST
    • Export an exception list POST
    • Get exception lists GET
    • Import an exception list POST
    • Get an exception list item GET
    • Create an exception list item POST
    • Update an exception list item PUT
    • Delete an exception list item DELETE
    • Get exception list items GET
    • Get an exception list summary GET
    • Create a shared exception list POST
  • Security lists
    • Lists requirements
    • Get list details GET
    • Create a list POST
    • Update a list PUT
    • Patch a list PATCH
    • Delete a list DELETE
    • Get lists GET
    • Get status of list data streams GET
    • Create list data streams POST
    • Delete list data streams DELETE
    • Get a list item GET
    • Create a list item POST
    • Update a list item PUT
    • Patch a list item PATCH
    • Delete a list item DELETE
    • Export list items POST
    • Get list items GET
    • Import list items POST
    • Get list privileges GET
  • Security Osquery
    • Get live queries GET
    • Create a live query POST
    • Get live query details GET
    • Get live query results GET
    • Get packs GET
    • Create a pack POST
    • Get pack details GET
    • Update a pack PUT
    • Delete a pack DELETE
    • Get saved queries GET
    • Create a saved query POST
    • Get saved query details GET
    • Update a saved query PUT
    • Delete a saved query DELETE
  • Security timeline
    • Get notes GET
    • Add or update a note PATCH
    • Delete a note DELETE
    • Pin/unpin an event PATCH
    • Get Timeline or Timeline template details GET
    • Create a Timeline or Timeline template POST
    • Update a Timeline PATCH
    • Delete Timelines or Timeline templates DELETE
    • Copies timeline or timeline template GET
    • Get draft Timeline or Timeline template details GET
    • Create a clean draft Timeline or Timeline template POST
    • Export Timelines POST
    • Favorite a Timeline or Timeline template PATCH
    • Import Timelines POST
    • Install prepackaged Timelines POST
    • Get an existing saved Timeline or Timeline template GET
    • Get Timelines or Timeline templates GET
  • Service level objectives
    • Get a paginated list of SLOs GET
    • Create an SLO POST
    • Bulk delete SLO definitions and their associated summary and rollup data. POST
    • Retrieve the status of the bulk deletion GET
    • Batch delete rollup and summary data POST
    • Batch delete rollup and summary data POST
    • Get an SLO GET
    • Update an SLO PUT
    • Delete an SLO DELETE
    • Reset an SLO POST
    • Disable an SLO POST
    • Enable an SLO POST
    • Get the SLO definitions GET
  • Short URLs
    • Create a short URL POST
    • Resolve a short URL GET
    • Get a short URL GET
    • Delete a short URL DELETE
  • Spaces
    • Copy saved objects between spaces POST
    • Disable legacy URL aliases POST
    • Get shareable references POST
    • Update saved objects in spaces POST
    • Get all spaces GET
    • Create a space POST
    • Get a space GET
    • Update a space PUT
    • Delete a space DELETE
  • Synthetics
    • Get monitors GET
    • Create a monitor POST
    • Delete monitors POST
    • Get a monitor GET
    • Update a monitor PUT
    • Delete a monitor DELETE
    • Get parameters GET
    • Add parameters POST
    • Delete parameters POST
    • Get a parameter GET
    • Update a parameter PUT
    • Delete a parameter DELETE
    • Get private locations GET
    • Create a private location POST
    • Get a private location GET
    • Update a private location PUT
    • Delete a private location DELETE
  • System
    • Get Kibana's current status GET
  • Task manager
    • Get the task manager health GET
  • Unknown
    • Query roles POST
    • Resolve conflicts copying saved objects POST
  • Upgrade assistant
    • Batch start or resume reindexing POST
    • Get the batch reindex queue GET
    • Get the reindex status GET
    • Start or resume reindexing POST
    • Cancel reindexing POST
    • Get the upgrade readiness status GET
  • Uptime
    • Get uptime settings GET
    • Update uptime settings PUT
  • User session management
    • Invalidate user sessions POST
Elastic logo
  • Trademarks
  • Terms of Use
  • Privacy
  • Sitemap

© 2026 Elasticsearch B.V. All Rights Reserved.

This content is available in different formats for convenience only. All original licensing terms apply.

Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Notice at Collection | Your Privacy Choices