POST /api/fleet/package_policies
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/package_policies

Refer to Spaces for more information.

Create a new package policy and assign it to an agent policy.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

Query parameters

  • format string

    Format for the response: simplified or legacy

    Values are simplified or legacy.

application/json

Body object

You should use inputs as an object and not use the deprecated inputs array.

Any of:
object-1 object object-2 object

Responses

  • 200 application/json

    Successful response

    Hide response attribute Show response attribute object
    • item object Required

      Additional properties are NOT allowed.

      Hide item attributes Show item attributes object
      • additional_datastreams_permissions array[string] | null

        Additional datastream permissions, that will be added to the agent policy.

        Not more than 1000 elements.

      • agents number
      • cloud_connector_id string | null

        ID of the cloud connector associated with this package policy.

      • cloud_connector_name string | null

        Transient field for cloud connector name during creation.

        Minimum length is 1, maximum length is 255.

      • created_at string Required
      • created_by string Required
      • description string

        Package policy description

      • elasticsearch object

        Additional properties are allowed.

        Hide elasticsearch attribute Show elasticsearch attribute object
        • privileges object

          Additional properties are allowed.

          Hide privileges attribute Show privileges attribute object
          • cluster array[string]

            Not more than 100 elements.

      • enabled boolean Required
      • global_data_tags array[object] | null

        Not more than 100 elements.

        Hide global_data_tags attributes Show global_data_tags attributes object
      • id string Required

        Package policy unique identifier.

      • inputs array[object] | object Required

        Package policy inputs.

        Any of:
        array-1 array[object] object-2 object

        Not more than 100 elements.

        Hide attributes Show attributes object
        • compiled_input Required
        • config object

          Package variable (see integration documentation for more information)

          Hide config attribute Show config attribute object
          • * object Additional properties

            Additional properties are NOT allowed.

            Hide * attributes Show * attributes object
            • frozen boolean
            • type string
            • value Required
        • deprecated object

          Additional properties are NOT allowed.

          Hide deprecated attributes Show deprecated attributes object
          • description string Required
          • replaced_by object
            Hide replaced_by attribute Show replaced_by attribute object
            • * string Additional properties
          • since string
        • enabled boolean Required
        • id string
        • keep_enabled boolean
        • migrate_from string
        • name string
        • policy_template string
        • streams array[object] Required

          Not more than 1000 elements.

          Hide streams attributes Show streams attributes object
          • compiled_stream Required
          • config object

            Package variable (see integration documentation for more information)

            Hide config attribute Show config attribute object
            • * object Additional properties

              Additional properties are NOT allowed.

              Hide * attributes Show * attributes object
              • frozen boolean
              • type string
              • value Required
          • data_stream object Required

            Additional properties are NOT allowed.

            Hide data_stream attributes Show data_stream attributes object
            • dataset string Required
            • elasticsearch object

              Additional properties are NOT allowed.

              Hide elasticsearch attributes Show elasticsearch attributes object
              • dynamic_dataset boolean
              • dynamic_namespace boolean
              • privileges object

                Additional properties are NOT allowed.

                Hide privileges attribute Show privileges attribute object
                • indices array[string]

                  Not more than 100 elements.

            • type string
          • deprecated object

            Additional properties are NOT allowed.

            Hide deprecated attributes Show deprecated attributes object
            • description string Required
            • replaced_by object
              Hide replaced_by attribute Show replaced_by attribute object
              • * string Additional properties
            • since string
          • enabled boolean Required
          • id string
          • keep_enabled boolean
          • migrate_from string
          • release string

            Values are ga, beta, or experimental.

          • var_group_selections object

            Variable group selections. Maps var_group name to the selected option name within that group.

            Hide var_group_selections attribute Show var_group_selections attribute object
            • * string Additional properties
          • vars object

            Package variable (see integration documentation for more information)

            Hide vars attribute Show vars attribute object
            • * object Additional properties

              Additional properties are NOT allowed.

              Hide * attributes Show * attributes object
              • frozen boolean
              • type string
              • value Required
        • type string Required
        • var_group_selections object

          Variable group selections. Maps var_group name to the selected option name within that group.

          Hide var_group_selections attribute Show var_group_selections attribute object
          • * string Additional properties
        • vars object

          Package variable (see integration documentation for more information)

          Hide vars attribute Show vars attribute object
          • * object Additional properties

            Additional properties are NOT allowed.

            Hide * attributes Show * attributes object
            • frozen boolean
            • type string
            • value Required
      • is_managed boolean
      • name string Required

        Unique name for the package policy.

      • namespace string

        The package policy namespace. Leave blank to inherit the agent policy's namespace.

      • output_id string | null
      • overrides object | null

        Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.

        Additional properties are NOT allowed.

        Hide overrides attribute Show overrides attribute object | null
        • inputs object
      • package object

        Additional properties are NOT allowed.

        Hide package attributes Show package attributes object
        • experimental_data_stream_features array[object]

          Not more than 100 elements.

          Hide experimental_data_stream_features attributes Show experimental_data_stream_features attributes object
          • data_stream string Required
          • features object Required

            Additional properties are NOT allowed.

            Hide features attributes Show features attributes object
            • doc_value_only_numeric boolean
            • doc_value_only_other boolean
            • synthetic_source boolean
            • tsdb boolean
        • fips_compatible boolean
        • name string Required

          Package name

        • requires_root boolean
        • title string
        • version string Required

          Package version

      • package_agent_version_condition string
      • policy_id string | null Deprecated

        ID of the agent policy which the package policy will be added to.

      • policy_ids array[string]

        IDs of the agent policies which that package policy will be added to.

        Not more than 1000 elements.

      • revision number Required

        Package policy revision.

      • secret_references array[object]

        Not more than 1000 elements.

        Hide secret_references attribute Show secret_references attribute object
        • id string Required
      • spaceIds array[string]

        Not more than 100 elements.

      • supports_agentless boolean | null

        Indicates whether the package policy belongs to an agentless agent policy.

        Default value is false.

      • supports_cloud_connector boolean | null

        Indicates whether the package policy supports cloud connectors.

        Default value is false.

      • updated_at string Required
      • updated_by string Required
      • var_group_selections object

        Variable group selections. Maps var_group name to the selected option name within that group.

        Hide var_group_selections attribute Show var_group_selections attribute object
        • * string Additional properties

      • vars object

        Package level variable.

        Any of:
        object-1 object object-2 object

        Input/stream level variable. Refer to the integration documentation for more information.

      • version string

        Package policy ES version.
  • 400 application/json

    Bad Request

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
  • 409 application/json

    Conflict

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
POST /api/fleet/package_policies 
curl \
 --request POST 'https://localhost:5601/api/fleet/package_policies' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"inputs":{},"name":"nginx-1","namespace":"default","package":{"name":"nginx","version":"1.20.0"},"policy_ids":["agent-policy-id-1"]}'
Request example
Create a new nginx package policy 
{
  "inputs": {},
  "name": "nginx-1",
  "namespace": "default",
  "package": {
    "name": "nginx",
    "version": "1.20.0"
  },
  "policy_ids": [
    "agent-policy-id-1"
  ]
}
Response examples (200)
The created package policy 
{
  "item": {
    "created_at": "2024-01-15T10:00:00.000Z",
    "enabled": true,
    "id": "package-policy-id-2",
    "inputs": [],
    "name": "nginx-1",
    "namespace": "default",
    "package": {
      "name": "nginx",
      "title": "Nginx",
      "version": "1.20.0"
    },
    "policy_ids": [
      "agent-policy-id-1"
    ],
    "updated_at": "2024-01-15T10:00:00.000Z"
  }
}
Response examples (400)
Example of a generic error response 
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}
Response examples (409)
A package policy with the same name already exists 
{
  "error": "Conflict",
  "message": "An error message describing what went wrong",
  "statusCode": 409
}