Access Kibana saved objects, dashboards, data views, spaces, alerts, and fleet via managed API authentication.
Important: All Kibana API requests require the kbn-xsrf: true header.
Reference
Get Status
GET /kibana/api/statusResponse:
{
"name": "kibana",
"uuid": "abc123",
"version": {
"number": "8.15.0",
"build_hash": "..."
},
"status": {
"overall": {"level": "available"}
}
}List Features
GET /kibana/api/featuresReturns list of all Kibana features and their capabilities.
Find Saved Objects
GET /kibana/api/saved_objects/_find?type={type}Query Parameters:
type- Object type:dashboard,visualization,index-pattern,search,lens,mapsearch- Search querypage- Page numberper_page- Results per page (default 20, max 10000)fields- Fields to return
Response:
{
"page": 1,
"per_page": 20,
"total": 5,
"saved_objects": [
{
"id": "abc123",
"type": "dashboard",
"attributes": {
"title": "My Dashboard",
"description": "Dashboard description"
},
"version": "1",
"updated_at": "2024-01-01T00:00:00.000Z"
}
]
}Get Saved Object
GET /kibana/api/saved_objects/{type}/{id}Create Saved Object
POST /kibana/api/saved_objects/{type}/{id}
Content-Type: application/json
{
"attributes": {
"title": "My Index Pattern",
"timeFieldName": "@timestamp"
}
}Update Saved Object
PUT /kibana/api/saved_objects/{type}/{id}
Content-Type: application/json
{
"attributes": {
"title": "Updated Title"
}
}Delete Saved Object
DELETE /kibana/api/saved_objects/{type}/{id}Bulk Operations
POST /kibana/api/saved_objects/_bulk_get
Content-Type: application/json
[
{"type": "dashboard", "id": "abc123"},
{"type": "visualization", "id": "def456"}
]List Data Views
GET /kibana/api/data_viewsResponse:
{
"data_view": [
{
"id": "abc123",
"title": "logs-*",
"timeFieldName": "@timestamp"
}
]
}Get Data View
GET /kibana/api/data_views/data_view/{id}Create Data View
POST /kibana/api/data_views/data_view
Content-Type: application/json
{
"data_view": {
"title": "logs-*",
"timeFieldName": "@timestamp"
}
}Response:
{
"data_view": {
"id": "abc123",
"title": "logs-*",
"timeFieldName": "@timestamp"
}
}Update Data View
POST /kibana/api/data_views/data_view/{id}
Content-Type: application/json
{
"data_view": {
"title": "updated-logs-*"
}
}Delete Data View
DELETE /kibana/api/data_views/data_view/{id}List Spaces
GET /kibana/api/spaces/spaceResponse:
[
{
"id": "default",
"name": "Default",
"description": "Default space",
"disabledFeatures": []
}
]Get Space
GET /kibana/api/spaces/space/{id}Create Space
POST /kibana/api/spaces/space
Content-Type: application/json
{
"id": "marketing",
"name": "Marketing",
"description": "Marketing team space",
"disabledFeatures": []
}Update Space
PUT /kibana/api/spaces/space/{id}
Content-Type: application/json
{
"id": "marketing",
"name": "Marketing Team",
"description": "Updated description"
}Delete Space
DELETE /kibana/api/spaces/space/{id}Find Alert Rules
GET /kibana/api/alerting/rules/_findQuery Parameters:
search- Search querypage- Page numberper_page- Results per page
Response:
{
"page": 1,
"per_page": 10,
"total": 5,
"data": [
{
"id": "abc123",
"name": "CPU Alert",
"consumer": "alerts",
"enabled": true,
"rule_type_id": "metrics.alert.threshold"
}
]
}Get Alert Rule
GET /kibana/api/alerting/rule/{id}Enable/Disable Rule
POST /kibana/api/alerting/rule/{id}/_enable
POST /kibana/api/alerting/rule/{id}/_disableMute/Unmute Rule
POST /kibana/api/alerting/rule/{id}/_mute_all
POST /kibana/api/alerting/rule/{id}/_unmute_allGet Alerting Health
GET /kibana/api/alerting/_healthExternal side effects. Executing a connector triggers actions outside Kibana (sending emails, posting to Slack, invoking webhooks, etc.). Always confirm the connector ID, action type, and full payload with the user before executing. Do not execute connectors proactively.
List Connectors
GET /kibana/api/actions/connectorsResponse:
[
{
"id": "abc123",
"name": "Email Connector",
"connector_type_id": ".email",
"is_preconfigured": false,
"is_deprecated": false
}
]Get Connector
GET /kibana/api/actions/connector/{id}List Connector Types
GET /kibana/api/actions/connector_typesExecute Connector
POST /kibana/api/actions/connector/{id}/_execute
Content-Type: application/json
{
"params": {
"to": ["user@example.com"],
"subject": "Alert",
"message": "Alert triggered"
}
}List Agent Policies
GET /kibana/api/fleet/agent_policiesResponse:
{
"items": [
{
"id": "abc123",
"name": "Default policy",
"namespace": "default",
"status": "active"
}
],
"total": 1,
"page": 1,
"perPage": 20
}List Agents
GET /kibana/api/fleet/agentsList Packages
GET /kibana/api/fleet/epm/packagesReturns all available integrations/packages.
Admin scope. Security role inspection reveals privilege configurations across the Kibana instance. This is read-only but exposes access control details.
List Roles
GET /kibana/api/security/roleResponse:
[
{
"name": "admin",
"metadata": {},
"elasticsearch": {
"cluster": ["all"],
"indices": [...]
},
"kibana": [...]
}
]Get Role
GET /kibana/api/security/role/{name}Find Cases
GET /kibana/api/cases/_findQuery Parameters:
status-open,in-progress,closedseverity-low,medium,high,criticalpage- Page numberperPage- Results per page
Response:
{
"cases": [],
"page": 1,
"per_page": 20,
"total": 0
}