@elastic/schemas 0.4.5 → 0.5.0

package/src/kibana/json/get_fleet_epm_packages.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"category":{"type":"string","description":"Filter packages by category","x-found-in":"query"},"prerelease":{"type":"boolean","description":"When true, include prerelease packages in the results","x-found-in":"query"},"excludeInstallStatus":{"type":"boolean","description":"When true, exclude the install status from the response","x-found-in":"query"},"withPackagePoliciesCount":{"type":"boolean","description":"When true, include the number of package policies per package","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-packages"}

package/src/kibana/json/get_fleet_epm_packages_bulk_rollback_taskid.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"taskId":{"type":"string","description":"Task ID of the bulk operation","x-found-in":"path"}},"required":["taskId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-packages-bulk-rollback-taskid"}

package/src/kibana/json/get_fleet_epm_packages_bulk_uninstall_taskid.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"taskId":{"type":"string","description":"Task ID of the bulk operation","x-found-in":"path"}},"required":["taskId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-packages-bulk-uninstall-taskid"}

package/src/kibana/json/get_fleet_epm_packages_bulk_upgrade_taskid.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"taskId":{"type":"string","description":"Task ID of the bulk operation","x-found-in":"path"}},"required":["taskId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-packages-bulk-upgrade-taskid"}

package/src/kibana/json/get_fleet_epm_packages_installed.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"dataStreamType":{"type":"string","description":"Filter by data stream type","x-found-in":"query"},"showOnlyActiveDataStreams":{"type":"boolean","description":"When true, only return packages with active data streams","x-found-in":"query"},"nameQuery":{"type":"string","description":"Filter packages by name","x-found-in":"query"},"searchAfter":{"type":"string","description":"Sort values from the previous page for `search_after` pagination","x-found-in":"query"},"perPage":{"type":"number","description":"Number of results per page","x-found-in":"query"},"sortOrder":{"type":"string","description":"Sort order, ascending or descending","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-packages-installed"}

package/src/kibana/json/get_fleet_epm_packages_pkgname.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"pkgName":{"type":"string","description":"Package name","x-found-in":"path"},"ignoreUnverified":{"type":"boolean","description":"When true, returns the package even if the signature cannot be verified","x-found-in":"query"},"prerelease":{"type":"boolean","description":"When true, include prerelease versions","x-found-in":"query"},"full":{"type":"boolean","description":"When true, return the full package info including assets","x-found-in":"query"},"withMetadata":{"type":"boolean","description":"When true, include package metadata such as whether it has package policies","x-found-in":"query"}},"required":["pkgName"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-packages-pkgname"}

package/src/kibana/json/get_fleet_epm_packages_pkgname_pkgversion.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"pkgName":{"type":"string","description":"Package name","x-found-in":"path"},"pkgVersion":{"type":"string","description":"Package version","x-found-in":"path"},"ignoreUnverified":{"type":"boolean","description":"When true, returns the package even if the signature cannot be verified","x-found-in":"query"},"prerelease":{"type":"boolean","description":"When true, include prerelease versions","x-found-in":"query"},"full":{"type":"boolean","description":"When true, return the full package info including assets","x-found-in":"query"},"withMetadata":{"type":"boolean","description":"When true, include package metadata such as whether it has package policies","x-found-in":"query"}},"required":["pkgName","pkgVersion"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-packages-pkgname-pkgversion"}

package/src/kibana/json/get_fleet_epm_packages_pkgname_pkgversion_dependencies.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"pkgName":{"type":"string","description":"Package name","x-found-in":"path"},"pkgVersion":{"type":"string","description":"Package version","x-found-in":"path"}},"required":["pkgName","pkgVersion"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-packages-pkgname-pkgversion-dependencies"}

package/src/kibana/json/get_fleet_epm_packages_pkgname_pkgversion_filepath.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"pkgName":{"type":"string","description":"Package name","x-found-in":"path"},"pkgVersion":{"type":"string","description":"Package version","x-found-in":"path"},"filePath":{"type":"string","description":"File path within the package","x-found-in":"path"}},"required":["pkgName","pkgVersion","filePath"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-packages-pkgname-pkgversion-filepath"}

package/src/kibana/json/get_fleet_epm_packages_pkgname_stats.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"pkgName":{"type":"string","description":"Package name","x-found-in":"path"}},"required":["pkgName"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-packages-pkgname-stats"}

package/src/kibana/json/get_fleet_epm_templates_pkgname_pkgversion_inputs.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"pkgName":{"type":"string","description":"Package name","x-found-in":"path"},"pkgVersion":{"type":"string","description":"Package version","x-found-in":"path"},"format":{"type":"string","description":"Output format for the inputs template: json, yml, or yaml","x-found-in":"query"},"prerelease":{"type":"boolean","description":"When true, allow prerelease versions","x-found-in":"query"},"ignoreUnverified":{"type":"boolean","description":"When true, return inputs even if the package signature cannot be verified","x-found-in":"query"}},"required":["pkgName","pkgVersion"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-epm-templates-pkgname-pkgversion-inputs"}

package/src/kibana/json/get_fleet_fleet_server_hosts_itemid.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"itemId":{"type":"string","description":"The ID of the Fleet Server host","x-found-in":"path"}},"required":["itemId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-fleet-server-hosts-itemid"}

package/src/kibana/json/get_fleet_kubernetes.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"download":{"type":"boolean","description":"If true, returns the manifest as a downloadable file","x-found-in":"query"},"fleetServer":{"type":"string","description":"Fleet Server host URL to include in the manifest","x-found-in":"query"},"enrolToken":{"type":"string","description":"Enrollment token to include in the manifest","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-kubernetes"}

package/src/kibana/json/get_fleet_kubernetes_download.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"download":{"type":"boolean","description":"If true, returns the manifest as a downloadable file","x-found-in":"query"},"fleetServer":{"type":"string","description":"Fleet Server host URL to include in the manifest","x-found-in":"query"},"enrolToken":{"type":"string","description":"Enrollment token to include in the manifest","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-kubernetes-download"}

package/src/kibana/json/get_fleet_outputs_outputid.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"outputId":{"type":"string","description":"The ID of the output","x-found-in":"path"}},"required":["outputId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-outputs-outputid"}

package/src/kibana/json/get_fleet_outputs_outputid_health.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"outputId":{"type":"string","description":"The ID of the output","x-found-in":"path"}},"required":["outputId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-outputs-outputid-health"}

package/src/kibana/json/get_fleet_package_policies.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"page":{"type":"number","description":"Page number","x-found-in":"query"},"perPage":{"type":"number","description":"Number of results per page","x-found-in":"query"},"sortField":{"type":"string","description":"Field to sort results by","x-found-in":"query"},"sortOrder":{"type":"string","description":"Sort order, ascending or descending","x-found-in":"query"},"showUpgradeable":{"type":"boolean","description":"When true, only show policies with available upgrades","x-found-in":"query"},"kuery":{"type":"string","description":"A KQL query string to filter results","x-found-in":"query"},"format":{"type":"string","description":"Format for the response: simplified or legacy","x-found-in":"query"},"withAgentCount":{"type":"boolean","description":"When true, include the agent count per package policy","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-package-policies"}

package/src/kibana/json/get_fleet_package_policies_packagepolicyid.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"packagePolicyId":{"type":"string","description":"The ID of the package policy","x-found-in":"path"},"format":{"type":"string","description":"Format for the response: simplified or legacy","x-found-in":"query"}},"required":["packagePolicyId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-package-policies-packagepolicyid"}

package/src/kibana/json/get_fleet_proxies_itemid.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"itemId":{"type":"string","description":"The ID of the proxy","x-found-in":"path"}},"required":["itemId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-proxies-itemid"}

package/src/kibana/json/get_fleet_uninstall_tokens.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"policyId":{"type":"string","description":"Partial match filtering for policy IDs","x-found-in":"query"},"search":{"type":"string","description":"Partial match filtering for uninstall token values","x-found-in":"query"},"perPage":{"type":"number","description":"The number of items to return","x-found-in":"query"},"page":{"type":"number","description":"Page number","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-uninstall-tokens"}

package/src/kibana/json/get_fleet_uninstall_tokens_uninstalltokenid.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"uninstallTokenId":{"type":"string","description":"The ID of the uninstall token","x-found-in":"path"}},"required":["uninstallTokenId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-fleet-uninstall-tokens-uninstalltokenid"}

package/src/kibana/json/get_maintenance_window_find.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"title":{"type":"string","description":"The title of the maintenance window.","x-found-in":"query"},"created_by":{"type":"string","description":"The user who created the maintenance window.","x-found-in":"query"},"status":{"type":"string","description":"The status of the maintenance window. It can be \"running\", \"upcoming\", \"finished\", \"archived\", or \"disabled\".","x-found-in":"query"},"page":{"type":"number","description":"The page number to return.","x-found-in":"query"},"per_page":{"type":"number","description":"The number of maintenance windows to return per page.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-maintenance-window-find"}

package/src/kibana/json/get_maintenance_window_id.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the maintenance window.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-maintenance-window-id"}

package/src/kibana/json/get_notes.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"documentIds":{"type":"string","description":"Event document `_id` values to match against each note's `eventId`. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using `page`/`perPage`.","x-found-in":"query"},"savedObjectIds":{"type":"string","description":"Timeline `savedObjectId` value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.","x-found-in":"query"},"page":{"type":"string","description":"Page number for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 1.","x-found-in":"query"},"perPage":{"type":"string","description":"Page size for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 10.","x-found-in":"query"},"search":{"type":"string","description":"Search string for saved-objects find (list mode only).","x-found-in":"query"},"sortField":{"type":"string","description":"Field to sort by for saved-objects find (list mode only).","x-found-in":"query"},"sortOrder":{"type":"string","description":"Sort order (`asc` or `desc`) for saved-objects find (list mode only).","x-found-in":"query"},"filter":{"type":"string","description":"Kuery filter string combined with other list-mode filters (for example `createdByFilter` or `associatedFilter`). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).","x-found-in":"query"},"createdByFilter":{"type":"string","description":"Kibana user profile **UID** (UUID). The server resolves the user's display identifiers and returns notes whose `createdBy` matches any of them (list mode only).","x-found-in":"query"},"associatedFilter":{"type":"string","description":"Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when `documentIds` or `savedObjectIds` is used.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetNotes"}

package/src/kibana/json/get_policy_response.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"agentId":{"type":"string","description":"The agent ID to retrieve the policy response for.","x-found-in":"query"}},"required":["agentId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetPolicyResponse"}

package/src/kibana/json/get_protection_updates_note.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"package_policy_id":{"type":"string","description":"The package policy ID to retrieve the protection updates note for.","x-found-in":"path"}},"required":["package_policy_id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetProtectionUpdatesNote"}

package/src/kibana/json/get_risk_score_history.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"entity_type":{"type":"string","description":"The type of entity to retrieve history for.","x-found-in":"query"},"entity_id":{"type":"string","description":"The identifier of the entity to retrieve history for.","x-found-in":"query"},"from":{"type":"string","description":"Start of the time range, in date-math syntax. Defaults to 90 days ago.","x-found-in":"query"},"to":{"type":"string","description":"End of the time range, in date-math syntax. Defaults to now.","x-found-in":"query"},"score_type":{"type":"string","description":"Filter entries by the type of score recorded (`base`, `propagated`, or `resolution`).","x-found-in":"query"},"page_size":{"type":"number","description":"Maximum number of history entries to return per request.","x-found-in":"query"}},"required":["entity_type","entity_id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetRiskScoreHistory"}

package/src/kibana/json/get_runtime_field_default.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"viewId":{"type":"string","description":"The viewId parameter","x-found-in":"path"},"fieldName":{"type":"string","description":"The fieldName parameter","x-found-in":"path"}},"required":["viewId","fieldName"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getRuntimeFieldDefault"}

package/src/kibana/json/get_security_entity_store_entities.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"filter":{"type":"string","description":"A Kibana Query Language (KQL) filter for the search-after mode.","x-found-in":"query"},"size":{"type":"number","description":"Number of entities to return in search-after mode.","x-found-in":"query"},"searchAfter":{"type":"string","description":"JSON-encoded search_after value for cursor-based pagination.","x-found-in":"query"},"source":{"type":"string","description":"Fields to include in the response source.","x-found-in":"query"},"fields":{"type":"string","description":"Fields to include in the response.","x-found-in":"query"},"sort_field":{"type":"string","description":"Field to sort results by in page mode.","x-found-in":"query"},"sort_order":{"type":"string","description":"Sort order in page mode.","x-found-in":"query"},"page":{"type":"number","description":"Page number to return (1-indexed) in page mode.","x-found-in":"query"},"per_page":{"type":"number","description":"Number of entities per page in page mode.","x-found-in":"query"},"filterQuery":{"type":"string","description":"An Elasticsearch query string to filter entities in page mode.","x-found-in":"query"},"entity_types":{"type":"string","description":"Entity types to include in the results.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-security-entity-store-entities"}

package/src/kibana/json/get_security_entity_store_resolution_group.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"entity_id":{"type":"string","description":"The entity identifier to look up the resolution group for.","x-found-in":"query"}},"required":["entity_id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-security-entity-store-resolution-group"}

package/src/kibana/json/get_security_entity_store_status.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"include_components":{"type":"string","description":"If true, returns a detailed status of each engine including all its components.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-security-entity-store-status"}

package/src/kibana/json/get_security_role.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"replaceDeprecatedPrivileges":{"type":"boolean","description":"If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-security-role"}

package/src/kibana/json/get_security_role_name.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"name":{"type":"string","description":"The role name.","x-found-in":"path"},"replaceDeprecatedPrivileges":{"type":"boolean","description":"If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.","x-found-in":"query"}},"required":["name"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-security-role-name"}

package/src/kibana/json/get_single_agent_configuration.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"name":{"type":"string","description":"Service name","x-found-in":"query"},"environment":{"type":"string","description":"Service environment","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getSingleAgentConfiguration"}

package/src/kibana/json/get_slo_op.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"spaceId":{"type":"string","description":"The spaceId parameter","x-found-in":"path"},"sloId":{"type":"string","description":"The sloId parameter","x-found-in":"path"},"instanceId":{"type":"string","description":"the specific instanceId used by the summary calculation","x-found-in":"query"}},"required":["spaceId","sloId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"getSloOp"}

package/src/kibana/json/get_spaces_space.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"purpose":{"type":"string","description":"Specifies which authorization checks are applied to the API call. The default value is `any`.","x-found-in":"query"},"include_authorized_purposes":{"type":"boolean","description":"When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter cannot be used together with the `purpose` parameter.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-spaces-space"}

package/src/kibana/json/get_spaces_space_id.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The space identifier.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-spaces-space-id"}

package/src/kibana/json/get_status.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"v7format":{"type":"boolean","description":"Set to \"true\" to get the response in v7 format.","x-found-in":"query"},"v8format":{"type":"boolean","description":"Set to \"true\" to get the response in v8 format.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-status"}

package/src/kibana/json/get_streams.request.json

@@ -1 +1 @@
-{"oneOf":[{"type":"object","properties":{}},{},{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams"}
+{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams"}

package/src/kibana/json/get_streams_name.request.json

@@ -1 +1 @@
-{"oneOf":[{"type":"object","properties":{}},{},{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-name"}
+{"type":"object","properties":{"name":{"type":"string","description":"The name of the stream.","x-found-in":"path"}},"required":["name"],"allOf":[{"type":"object"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-name"}

package/src/kibana/json/get_streams_name_ingest.request.json

@@ -1 +1 @@
-{"oneOf":[{"type":"object","properties":{}},{},{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-name-ingest"}
+{"type":"object","properties":{"name":{"type":"string","description":"The name of the stream.","x-found-in":"path"}},"required":["name"],"allOf":[{"type":"object"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-name-ingest"}

package/src/kibana/json/get_streams_name_queries.request.json

@@ -1 +1 @@
-{"oneOf":[{"type":"object","properties":{}},{},{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-name-queries"}
+{"type":"object","properties":{"name":{"type":"string","description":"The name of the stream.","x-found-in":"path"}},"required":["name"],"allOf":[{"type":"object"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-name-queries"}

package/src/kibana/json/get_streams_name_query.request.json

@@ -1 +1 @@
-{"oneOf":[{"type":"object","properties":{}},{},{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-name-query"}
+{"type":"object","properties":{"name":{"type":"string","description":"The name of the query stream.","x-found-in":"path"}},"required":["name"],"allOf":[{"type":"object"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-name-query"}

package/src/kibana/json/get_streams_name_significant_events.request.json

@@ -1 +1 @@
-{"oneOf":[{"type":"object","properties":{}},{},{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-name-significant-events"}
+{"type":"object","properties":{"name":{"type":"string","description":"The name of the stream.","x-found-in":"path"},"from":{"type":"string","description":"Start of the time range as an ISO 8601 date string.","x-found-in":"query"},"to":{"type":"string","description":"End of the time range as an ISO 8601 date string.","x-found-in":"query"},"bucketSize":{"type":"string","description":"The bucket size for aggregating events (e.g. \"1m\", \"1h\").","x-found-in":"query"},"query":{"type":"string","description":"Query string to filter significant events on metadata fields","x-found-in":"query"},"searchMode":{"type":"string","description":"Search mode: keyword (BM25), semantic (vector), or hybrid (RRF). When omitted, defaults to hybrid with a silent keyword fallback on failure. When set explicitly, failures propagate as errors.","x-found-in":"query"}},"required":["name","from","to","bucketSize"],"allOf":[{"type":"object"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-name-significant-events"}

package/src/kibana/json/get_streams_streamname_attachments.request.json

@@ -1 +1 @@
-{"oneOf":[{"type":"object","properties":{}},{},{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-streamname-attachments"}
+{"type":"object","properties":{"streamName":{"type":"string","description":"The name of the stream","x-found-in":"path"},"query":{"type":"string","description":"Search query to filter attachments by title","x-found-in":"query"},"attachmentTypes":{"type":"string","description":"Filter by attachment types (single value or array)","x-found-in":"query"},"tags":{"type":"string","description":"Filter by tags (single value or array)","x-found-in":"query"}},"required":["streamName"],"allOf":[{"type":"object"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-streams-streamname-attachments"}

package/src/kibana/json/get_tags.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"query":{"type":"string","description":"Filters results by `name` and `description` using Elasticsearch [`simple_query_string`](https://www.elastic.co/docs/reference/query-languages/query-dsl/simple-query-string-query) syntax. Multi-word terms require all words to match.","x-found-in":"query"},"page":{"type":"number","description":"The page of results to return.","x-found-in":"query"},"per_page":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-tags"}

package/src/kibana/json/get_tags_id.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The tag ID, as returned by the create or search endpoints.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-tags-id"}

package/src/kibana/json/get_timeline.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"template_timeline_id":{"type":"string","description":"The `savedObjectId` of the Timeline template to retrieve.","x-found-in":"query"},"id":{"type":"string","description":"The `savedObjectId` of the Timeline to retrieve.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetTimeline"}

package/src/kibana/json/get_timelines.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"only_user_favorite":{"type":"string","description":"If `true`, only Timelines that the current user has marked as favorite are returned.","x-found-in":"query"},"timeline_type":{"type":"string","description":"Restrict results to `default` investigation timelines or `template` timeline templates.","x-found-in":"query"},"sort_field":{"type":"string","description":"Field used to sort the list (`title`, `description`, `updated`, or `created`).","x-found-in":"query"},"sort_order":{"type":"string","description":"Whether to sort the results `ascending` or `descending`","x-found-in":"query"},"page_size":{"type":"string","description":"How many results should returned at once","x-found-in":"query"},"page_index":{"type":"string","description":"How many pages should be skipped","x-found-in":"query"},"search":{"type":"string","description":"Allows to search for timelines by their title","x-found-in":"query"},"status":{"type":"string","description":"Filter by timeline lifecycle state (`active`, `draft`, or `immutable`).","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetTimelines"}

package/src/kibana/json/get_visualization_redirect.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The id parameter","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-visualization-redirect"}

package/src/kibana/json/get_watchlist.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"Unique ID of the watchlist","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"GetWatchlist"}

package/src/kibana/json/get_workflows.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"query":{"type":"string","description":"Free-text search query.","x-found-in":"query"},"size":{"type":"number","description":"Number of results per page.","x-found-in":"query"},"page":{"type":"number","description":"Page number.","x-found-in":"query"},"enabled":{"type":"string","description":"Filter by enabled state.","x-found-in":"query"},"createdBy":{"type":"string","description":"Filter by creator.","x-found-in":"query"},"tags":{"type":"string","description":"Filter by tags.","x-found-in":"query"},"managed":{"type":"string","description":"Filter by managed status. Defaults to \"unmanaged\".","x-found-in":"query"},"sortField":{"type":"string","description":"Field to sort by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"Sort direction.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-workflows"}

package/src/kibana/json/get_workflows_aggs.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"fields":{"type":"string","description":"Field or fields to aggregate on.","x-found-in":"query"},"managed":{"type":"string","description":"Filter aggregations by managed status.","x-found-in":"query"}},"required":["fields"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-workflows-aggs"}

package/src/kibana/json/get_workflows_executions_executionid.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"executionId":{"type":"string","description":"Workflow execution ID","x-found-in":"path"},"includeInput":{"type":"boolean","description":"Include execution input data.","x-found-in":"query"},"includeOutput":{"type":"boolean","description":"Include execution output data.","x-found-in":"query"}},"required":["executionId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-workflows-executions-executionid"}

package/src/kibana/json/get_workflows_executions_executionid_children.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"executionId":{"type":"string","description":"Workflow execution ID","x-found-in":"path"}},"required":["executionId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-workflows-executions-executionid-children"}

package/src/kibana/json/get_workflows_executions_executionid_logs.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"executionId":{"type":"string","description":"Workflow execution ID","x-found-in":"path"},"stepExecutionId":{"type":"string","description":"Filter logs by a specific step execution ID.","x-found-in":"query"},"size":{"type":"number","description":"Number of log entries per page.","x-found-in":"query"},"page":{"type":"number","description":"Page number.","x-found-in":"query"},"sortField":{"type":"string","description":"Field to sort by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"Sort order.","x-found-in":"query"}},"required":["executionId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-workflows-executions-executionid-logs"}

package/src/kibana/json/get_workflows_executions_executionid_step_stepexecutionid.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"executionId":{"type":"string","description":"Workflow execution ID.","x-found-in":"path"},"stepExecutionId":{"type":"string","description":"Step execution ID.","x-found-in":"path"}},"required":["executionId","stepExecutionId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-workflows-executions-executionid-step-stepexecutionid"}

package/src/kibana/json/get_workflows_schema.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"loose":{"type":"boolean","description":"When true, returns a permissive schema that allows additional properties. When false, returns a strict schema for full validation.","x-found-in":"query"}},"required":["loose"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-workflows-schema"}

package/src/kibana/json/get_workflows_workflow_id.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"Workflow ID","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-workflows-workflow-id"}

package/src/kibana/json/get_workflows_workflow_workflowid_executions.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"workflowId":{"type":"string","description":"Workflow ID","x-found-in":"path"},"statuses":{"type":"string","description":"Filter by execution status.","x-found-in":"query"},"executionTypes":{"type":"string","description":"Filter by execution type.","x-found-in":"query"},"executedBy":{"type":"string","description":"Filter by the user who triggered the execution.","x-found-in":"query"},"concurrencyGroupKey":{"type":"string","description":"Filter by evaluated concurrency group key.","x-found-in":"query"},"omitStepRuns":{"type":"boolean","description":"Whether to exclude step-level execution data.","x-found-in":"query"},"finishedAfter":{"type":"string","description":"Datemath lower bound for filtering executions by finishedAt (inclusive when parsed).","x-found-in":"query"},"finishedBefore":{"type":"string","description":"Datemath upper bound for filtering executions by finishedAt (inclusive when parsed with roundUp).","x-found-in":"query"},"collapse":{"type":"string","description":"Field to collapse execution results by.","x-found-in":"query"},"sortField":{"type":"string","description":"Field to sort executions by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"Sort order.","x-found-in":"query"},"page":{"type":"number","description":"Page number.","x-found-in":"query"},"size":{"type":"number","description":"Number of results per page.","x-found-in":"query"},"startedAfter":{"type":"string","description":"Datemath lower bound for filtering executions by startedAt (inclusive when parsed).","x-found-in":"query"},"startedBefore":{"type":"string","description":"Datemath upper bound for filtering executions by startedAt (inclusive when parsed with roundUp).","x-found-in":"query"}},"required":["workflowId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-workflows-workflow-workflowid-executions"}

package/src/kibana/json/get_workflows_workflow_workflowid_executions_steps.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"workflowId":{"type":"string","description":"Workflow ID","x-found-in":"path"},"stepId":{"type":"string","description":"Filter by step ID.","x-found-in":"query"},"includeInput":{"type":"boolean","description":"Include step input data.","x-found-in":"query"},"includeOutput":{"type":"boolean","description":"Include step output data.","x-found-in":"query"},"page":{"type":"number","description":"Page number for pagination.","x-found-in":"query"},"size":{"type":"number","description":"Number of results per page.","x-found-in":"query"},"startedAfter":{"type":"string","description":"Datemath lower bound for filtering step executions by startedAt (inclusive when parsed).","x-found-in":"query"},"startedBefore":{"type":"string","description":"Datemath upper bound for filtering step executions by startedAt (inclusive when parsed with roundUp).","x-found-in":"query"}},"required":["workflowId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"get-workflows-workflow-workflowid-executions-steps"}

package/src/kibana/json/import_exception_list.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"overwrite":{"type":"boolean","description":"Determines whether existing exception lists with the same `list_id` are overwritten.","x-found-in":"query"},"as_new_list":{"type":"boolean","description":"Determines whether the list being imported will have a new `list_id` generated.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ImportExceptionList"}

package/src/kibana/json/import_list_items.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"list_id":{"type":"string","description":"List's id.","x-found-in":"query"},"type":{"type":"string","description":"Type of the importing list.","x-found-in":"query"},"refresh":{"type":"string","description":"Determines when changes made by the request are made visible to search.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ImportListItems"}

package/src/kibana/json/import_rules.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"overwrite":{"type":"boolean","description":"Determines whether existing rules with the same `rule_id` are overwritten.","x-found-in":"query"},"overwrite_exceptions":{"type":"boolean","description":"Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten.","x-found-in":"query"},"overwrite_action_connectors":{"type":"boolean","description":"Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten.","x-found-in":"query"},"as_new_list":{"type":"boolean","description":"Generates a new list ID for each imported exception list.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ImportRules"}

package/src/kibana/json/init_entity_engine.request.json

@@ -1 +1 @@
-{"type":"object","properties":{"delay":{"type":"string","description":"The delay before the transform will run."},"docsPerSecond":{"type":"number","description":"The number of documents per second to process."},"enrichPolicyExecutionInterval":{"$ref":"./_defs.json#/$defs/Security_Entity_Analytics_API_Interval"},"fieldHistoryLength":{"type":"number","description":"The number of historical values to keep for each field."},"filter":{"type":"string"},"frequency":{"type":"string","description":"The frequency at which the transform will run."},"indexPattern":{"$ref":"./_defs.json#/$defs/Security_Entity_Analytics_API_IndexPattern"},"lookbackPeriod":{"type":"string","description":"The amount of time the transform looks back to calculate the aggregations."},"maxPageSearchSize":{"type":"number","description":"The initial page size to use for the composite aggregation of each checkpoint."},"timeout":{"type":"string","description":"The timeout for initializing the aggregating transform."},"timestampField":{"type":"string","description":"The field to use as the timestamp for the entity type."}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"InitEntityEngine"}
+{"type":"object","properties":{"entityType":{"type":"string","description":"The entity type of the engine.","x-found-in":"path"}},"required":["entityType"],"allOf":[{"type":"object","properties":{"delay":{"type":"string","description":"The delay before the transform will run."},"docsPerSecond":{"type":"number","description":"The number of documents per second to process."},"enrichPolicyExecutionInterval":{"$ref":"./_defs.json#/$defs/Security_Entity_Analytics_API_Interval"},"fieldHistoryLength":{"type":"number","description":"The number of historical values to keep for each field."},"filter":{"type":"string"},"frequency":{"type":"string","description":"The frequency at which the transform will run."},"indexPattern":{"$ref":"./_defs.json#/$defs/Security_Entity_Analytics_API_IndexPattern"},"lookbackPeriod":{"type":"string","description":"The amount of time the transform looks back to calculate the aggregations."},"maxPageSearchSize":{"type":"number","description":"The initial page size to use for the composite aggregation of each checkpoint."},"timeout":{"type":"string","description":"The timeout for initializing the aggregating transform."},"timestampField":{"type":"string","description":"The field to use as the timestamp for the entity type."}}}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"InitEntityEngine"}

package/src/kibana/json/list_entities.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"sort_field":{"type":"string","description":"Field to sort results by.","x-found-in":"query"},"sort_order":{"type":"string","description":"Sort order.","x-found-in":"query"},"page":{"type":"number","description":"Page number to return (1-indexed).","x-found-in":"query"},"per_page":{"type":"number","description":"Number of entities per page.","x-found-in":"query"},"filterQuery":{"type":"string","description":"An ES query to filter by.","x-found-in":"query"},"entity_types":{"type":"string","description":"Entity types to include in the results.","x-found-in":"query"}},"required":["entity_types"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ListEntities"}

package/src/kibana/json/list_priv_mon_users.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"kql":{"type":"string","description":"KQL query to filter the list of monitored users","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"ListPrivMonUsers"}

package/src/kibana/json/osquery_copy_packs.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The ID of the pack to copy.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCopyPacks"}

package/src/kibana/json/osquery_copy_saved_query.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The ID of the saved query to copy.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryCopySavedQuery"}

package/src/kibana/json/osquery_delete_packs.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The pack ID.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryDeletePacks"}

package/src/kibana/json/osquery_delete_saved_query.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The saved query ID.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryDeleteSavedQuery"}

package/src/kibana/json/osquery_find_live_queries.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"kuery":{"type":"string","description":"A KQL search string to filter live queries.","x-found-in":"query"},"page":{"type":"number","description":"The page number to return.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"},"sort":{"type":"string","description":"The field to sort results by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"The sort order.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryFindLiveQueries"}

package/src/kibana/json/osquery_find_packs.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"page":{"type":"number","description":"The page number to return.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"},"sort":{"type":"string","description":"The field to sort results by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"The sort order.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryFindPacks"}

package/src/kibana/json/osquery_find_saved_queries.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"page":{"type":"number","description":"The page number to return.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"},"sort":{"type":"string","description":"The field to sort results by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"The sort order.","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryFindSavedQueries"}

package/src/kibana/json/osquery_get_live_query_details.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The ID of the live query.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetLiveQueryDetails"}

package/src/kibana/json/osquery_get_live_query_results.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The ID of the live query.","x-found-in":"path"},"actionId":{"type":"string","description":"The ID of the query action.","x-found-in":"path"},"kuery":{"type":"string","description":"A KQL search string to filter results.","x-found-in":"query"},"page":{"type":"number","description":"The page number to return.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"},"sort":{"type":"string","description":"The field to sort results by.","x-found-in":"query"},"sortOrder":{"type":"string","description":"The sort order.","x-found-in":"query"}},"required":["id","actionId"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetLiveQueryResults"}

package/src/kibana/json/osquery_get_packs_details.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The pack ID.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetPacksDetails"}

package/src/kibana/json/osquery_get_saved_query_details.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The saved query ID.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetSavedQueryDetails"}

package/src/kibana/json/osquery_get_scheduled_action_results.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"scheduleId":{"type":"string","description":"The schedule ID of the scheduled query.","x-found-in":"path"},"executionCount":{"type":"number","description":"The execution count for this scheduled query run.","x-found-in":"path"},"kuery":{"type":"string","description":"The kuery to filter the results by.","x-found-in":"query"},"page":{"type":"number","description":"The page number to return. The default is 1.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page. The default is 20.","x-found-in":"query"},"sort":{"type":"string","description":"The field that is used to sort the results.","x-found-in":"query"},"sortOrder":{"type":"string","description":"Specifies the sort order.","x-found-in":"query"}},"required":["scheduleId","executionCount"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetScheduledActionResults"}

package/src/kibana/json/osquery_get_scheduled_query_results.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"scheduleId":{"type":"string","description":"The schedule ID of the scheduled query.","x-found-in":"path"},"executionCount":{"type":"number","description":"The execution count for this scheduled query run.","x-found-in":"path"},"kuery":{"type":"string","description":"The kuery to filter the results by.","x-found-in":"query"},"page":{"type":"number","description":"The page number to return. The default is 1.","x-found-in":"query"},"pageSize":{"type":"number","description":"The number of results to return per page. The default is 20.","x-found-in":"query"},"sort":{"type":"string","description":"The field that is used to sort the results.","x-found-in":"query"},"sortOrder":{"type":"string","description":"Specifies the sort order.","x-found-in":"query"},"startDate":{"type":"string","description":"The start date filter (ISO 8601) to narrow down results.","x-found-in":"query"}},"required":["scheduleId","executionCount"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetScheduledQueryResults"}

package/src/kibana/json/osquery_get_unified_history.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"pageSize":{"type":"number","description":"The number of results to return per page.","x-found-in":"query"},"nextPage":{"type":"string","description":"A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.","x-found-in":"query"},"kuery":{"type":"string","description":"A search string to filter history entries by pack name, query text, or query ID.","x-found-in":"query"},"userIds":{"type":"string","description":"Comma-separated list of user IDs to filter live query history.","x-found-in":"query"},"sourceFilters":{"type":"string","description":"Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.","x-found-in":"query"},"startDate":{"type":"string","description":"The start of the time range filter (ISO 8601).","x-found-in":"query"},"endDate":{"type":"string","description":"The end of the time range filter (ISO 8601).","x-found-in":"query"}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryGetUnifiedHistory"}

package/src/kibana/json/osquery_update_packs.request.json

@@ -1 +1 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_UpdatePacksRequestBody","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryUpdatePacks"}
+{"type":"object","properties":{"id":{"type":"string","description":"The pack ID.","x-found-in":"path"}},"required":["id"],"allOf":[{"$ref":"./_defs.json#/$defs/Security_Osquery_API_UpdatePacksRequestBody"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryUpdatePacks"}

package/src/kibana/json/osquery_update_saved_query.request.json

@@ -1 +1 @@
-{"$ref":"./_defs.json#/$defs/Security_Osquery_API_UpdateSavedQueryRequestBody","$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryUpdateSavedQuery"}
+{"type":"object","properties":{"id":{"type":"string","description":"The saved query ID.","x-found-in":"path"}},"required":["id"],"allOf":[{"$ref":"./_defs.json#/$defs/Security_Osquery_API_UpdateSavedQueryRequestBody"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"OsqueryUpdateSavedQuery"}

package/src/kibana/json/patch_agent_builder_conversations_conversation_id_attachments_attachment_id.request.json

@@ -1 +1 @@
-{"type":"object","properties":{"description":{"type":"string","description":"The new description/name for the attachment."}},"required":["description"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"patch-agent-builder-conversations-conversation-id-attachments-attachment-id"}
+{"type":"object","properties":{"conversation_id":{"type":"string","description":"The unique identifier of the conversation.","x-found-in":"path"},"attachment_id":{"type":"string","description":"The unique identifier of the attachment to rename.","x-found-in":"path"}},"required":["conversation_id","attachment_id"],"allOf":[{"type":"object","properties":{"description":{"type":"string","description":"The new description/name for the attachment."}},"required":["description"]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"patch-agent-builder-conversations-conversation-id-attachments-attachment-id"}

package/src/kibana/json/patch_maintenance_window_id.request.json

@@ -1 +1 @@
-{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_update_maintenance_window","$schema":"https://json-schema.org/draft/2020-12/schema","title":"patch-maintenance-window-id"}
+{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the maintenance window.","x-found-in":"path"}},"required":["id"],"allOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_update_maintenance_window"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"patch-maintenance-window-id"}

package/src/kibana/json/perform_rules_bulk_action.request.json

@@ -1 +1 @@
-{"oneOf":[{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkDeleteRules"},{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkDisableRules"},{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkEnableRules"},{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkExportRules"},{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkDuplicateRules"},{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkManualRuleRun"},{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkManualRuleFillGaps"},{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkEditRules"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformRulesBulkAction"}
+{"type":"object","properties":{"dry_run":{"type":"boolean","description":"Enables dry run mode for the request call.","x-found-in":"query"}},"allOf":[{"type":"object","properties":{"action":{"enum":["edit"]},"gap_auto_fill_scheduler_id":{"type":"string","description":"Gap auto fill scheduler ID used to determine gap fill status for rules"},"gap_fill_statuses":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_GapFillStatus"},"description":"Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*)."},"gaps_range_end":{"type":"string","description":"Gaps range end, valid only when query is provided"},"gaps_range_start":{"type":"string","description":"Gaps range start, valid only when query is provided"},"ids":{"type":"array","items":{"type":"string"},"description":"Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"},"query":{"type":"string","description":"Query to filter rules."},"duplicate":{"type":"object","properties":{"include_exceptions":{"type":"boolean","description":"Whether to copy exceptions from the original rule"},"include_expired_exceptions":{"type":"boolean","description":"Whether to copy expired exceptions from the original rule"}},"required":["include_exceptions","include_expired_exceptions"],"description":"Duplicate object that describes applying an update action."},"run":{"type":"object","properties":{"end_date":{"type":"string","description":"End date of the manual rule run"},"start_date":{"type":"string","description":"Start date of the manual rule run"}},"required":["start_date","end_date"],"description":"Object that describes applying a manual rule run action."},"fill_gaps":{"type":"object","properties":{"end_date":{"type":"string","description":"End date of the manual gap fill"},"start_date":{"type":"string","description":"Start date of the manual gap fill"}},"required":["start_date","end_date"],"description":"Object that describes applying a manual gap fill action for the specified time range."},"edit":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Security_Detections_API_BulkActionEditPayload"},"description":"Array of objects containing the edit operations"}},"required":["action"]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"PerformRulesBulkAction"}

package/src/kibana/json/post_actions_connector_id.request.json

@@ -1 +1 @@
-{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_new_connector","$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-actions-connector-id"}
+{"type":"object","properties":{"id":{"type":"string","description":"An identifier for the connector.","x-found-in":"path"}},"required":["id"],"allOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_new_connector"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-actions-connector-id"}

package/src/kibana/json/post_actions_connector_id_execute.request.json

@@ -1 +1 @@
-{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_connector_execute_request","$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-actions-connector-id-execute"}
+{"type":"object","properties":{"id":{"type":"string","description":"An identifier for the connector.","x-found-in":"path"}},"required":["id"],"allOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_connector_execute_request"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-actions-connector-id-execute"}

package/src/kibana/json/post_agent_builder_a2a_agentid.request.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-a2a-agentid"}
+{"type":"object","properties":{"agentId":{"type":"string","description":"The unique identifier of the agent to send the A2A task to.","x-found-in":"path"}},"required":["agentId"],"allOf":[{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-a2a-agentid"}

package/src/kibana/json/post_agent_builder_agents_agent_id_consumption.request.json

@@ -1 +1 @@
-{"type":"object","properties":{"has_warnings":{"type":"boolean","description":"Filter to conversations with or without high-token warnings."},"search":{"type":"string","description":"Free-text search filter on conversation title."},"search_after":{"type":"array","items":{},"description":"Cursor for pagination. Pass the search_after value from the previous response."},"size":{"type":"number","description":"Number of results per page."},"sort_field":{"enum":["updated_at","total_tokens","round_count"],"description":"Field to sort results by."},"sort_order":{"enum":["asc","desc"],"description":"Sort direction."},"usernames":{"type":"array","items":{"type":"string"},"description":"Filter results to conversations by these usernames."}},"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-agents-agent-id-consumption"}
+{"type":"object","properties":{"agent_id":{"type":"string","description":"The unique identifier of the agent.","x-found-in":"path"}},"required":["agent_id"],"allOf":[{"type":"object","properties":{"has_warnings":{"type":"boolean","description":"Filter to conversations with or without high-token warnings."},"search":{"type":"string","description":"Free-text search filter on conversation title."},"search_after":{"type":"array","items":{},"description":"Cursor for pagination. Pass the search_after value from the previous response."},"size":{"type":"number","description":"Number of results per page."},"sort_field":{"enum":["updated_at","total_tokens","round_count"],"description":"Field to sort results by."},"sort_order":{"enum":["asc","desc"],"description":"Sort direction."},"usernames":{"type":"array","items":{"type":"string"},"description":"Filter results to conversations by these usernames."}}}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-agents-agent-id-consumption"}

package/src/kibana/json/post_agent_builder_conversations_conversation_id_attachments.request.json

@@ -1 +1 @@
-{"type":"object","properties":{"data":{"description":"The attachment data/content. Required unless origin is provided."},"description":{"type":"string","description":"Human-readable description of the attachment."},"hidden":{"type":"boolean","description":"Whether the attachment should be hidden from the user."},"id":{"type":"string","description":"Optional custom ID for the attachment."},"origin":{"type":"string","description":"Origin string (for example, saved object ID) for by-reference attachments. When provided without data, the content is resolved once at creation time."},"type":{"type":"string","description":"The type of the attachment (e.g., text, esql, visualization)."}},"required":["type","data"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-conversations-conversation-id-attachments"}
+{"type":"object","properties":{"conversation_id":{"type":"string","description":"The unique identifier of the conversation.","x-found-in":"path"}},"required":["conversation_id"],"allOf":[{"type":"object","properties":{"data":{"description":"The attachment data/content. Required unless origin is provided."},"description":{"type":"string","description":"Human-readable description of the attachment."},"hidden":{"type":"boolean","description":"Whether the attachment should be hidden from the user."},"id":{"type":"string","description":"Optional custom ID for the attachment."},"origin":{"type":"string","description":"Origin string (for example, saved object ID) for by-reference attachments. When provided without data, the content is resolved once at creation time."},"type":{"type":"string","description":"The type of the attachment (e.g., text, esql, visualization)."}},"required":["type","data"]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-conversations-conversation-id-attachments"}

package/src/kibana/json/post_agent_builder_conversations_conversation_id_attachments_attachment_id_restore.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"conversation_id":{"type":"string","description":"The unique identifier of the conversation.","x-found-in":"path"},"attachment_id":{"type":"string","description":"The unique identifier of the attachment to restore.","x-found-in":"path"}},"required":["conversation_id","attachment_id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-conversations-conversation-id-attachments-attachment-id-restore"}

package/src/kibana/json/post_agent_builder_mcp.request.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-mcp"}
+{"type":"object","properties":{"namespace":{"type":"string","description":"Comma-separated list of namespaces to filter tools. Only tools matching the specified namespaces will be returned.","x-found-in":"query"}},"allOf":[{}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-agent-builder-mcp"}

package/src/kibana/json/post_alerting_rule_id.request.json

@@ -1 +1 @@
-{"oneOf":[{"oneOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-cluster-health-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-cpu-usage-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-disk-usage-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-elasticsearch-version-mismatch-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-kibana-version-mismatch-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-license-expiration-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-logstash-version-mismatch-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-jvm-memory-usage-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-missing-monitoring-data-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-nodes-changed-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-shard-size-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-thread-pool-search-rejections-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_monitoring-alert-thread-pool-write-rejections-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_xpack-ml-anomaly-detection-alert-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_xpack-ml-anomaly-detection-jobs-health-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_datasetquality-degradeddocs-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_es-query-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_index-threshold-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_geo-containment-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_transform-health-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_apm-anomaly-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_apm-error-rate-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_apm-transaction-error-rate-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_apm-transaction-duration-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_xpack-synthetics-alerts-monitorstatus-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_xpack-synthetics-alerts-tls-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_xpack-uptime-alerts-monitorstatus-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_xpack-uptime-alerts-tlscertificate-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_xpack-uptime-alerts-durationanomaly-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_metrics-alert-inventory-threshold-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_metrics-alert-threshold-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_observability-rules-custom-threshold-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_logs-alert-document-count-create-rule-body-alerting"},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_slo-rules-burnrate-create-rule-body-alerting"}]},{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_new_rule"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id"}
+{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the rule. If it is omitted, an ID is randomly generated.","x-found-in":"path"}},"required":["id"],"allOf":[{"type":"object","properties":{"actions":{"type":"array","items":{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_new_rule_action"}},"alert_delay":{"type":"object","properties":{"active":{"type":"number","description":"The number of consecutive runs that must meet the rule conditions."}},"required":["active"],"description":"Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."},"artifacts":{"type":"object","properties":{"dashboards":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"]}},"investigation_guide":{"type":"object","properties":{"blob":{"type":"string"}},"required":["blob"]}}},"consumer":{"type":"string","description":"The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."},"enabled":{"type":"boolean","description":"Indicates whether you want the rule to run on an interval basis after it is created."},"flapping":{"oneOf":[{"$ref":"./_defs.json#/$defs/Kibana_HTTP_APIs_rule_flapping"},{"type":"null"}]},"name":{"type":"string","description":"The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."},"notify_when":{"enum":["onActionGroupChange","onActiveAlert","onThrottleInterval",null,null],"description":"Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."},"params":{"type":"object","additionalProperties":{},"description":"The parameters for the rule."},"rule_type_id":{"type":"string","description":"The rule type identifier."},"schedule":{"type":"object","properties":{"interval":{"type":"string","description":"The interval is specified in seconds, minutes, hours, or days."}},"required":["interval"],"description":"The check interval, which specifies how frequently the rule conditions are checked."},"tags":{"type":"array","items":{"type":"string"},"description":"The tags for the rule."},"throttle":{"oneOf":[{"type":"string"},{"type":"null"}],"description":"Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."}},"required":["name","consumer","schedule","rule_type_id"]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id"}

package/src/kibana/json/post_alerting_rule_id_disable.request.json

@@ -1 +1 @@
-{"oneOf":[{"type":"object","properties":{"untrack":{"type":"boolean","description":"Defines whether this rule's alerts should be untracked."}}},{"type":"null"}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id-disable"}
+{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the rule.","x-found-in":"path"}},"required":["id"],"allOf":[{"oneOf":[{"type":"object","properties":{"untrack":{"type":"boolean","description":"Defines whether this rule's alerts should be untracked."}}},{"type":"null"}]}],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id-disable"}

package/src/kibana/json/post_alerting_rule_id_enable.request.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"id":{"type":"string","description":"The identifier for the rule.","x-found-in":"path"}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema","title":"post-alerting-rule-id-enable"}