Kibana APIs — Elastic Agent actions

naftiko: 1.0.0-alpha2
info:
  label: Kibana APIs — Elastic Agent actions
  description: 'Kibana APIs — Elastic Agent actions. 14 operations. Lead operation: Get an agent action status. Self-contained
    Naftiko capability covering one Kibana business surface.'
  tags:
  - Kibana
  - Elastic Agent actions
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    KIBANA_API_KEY: KIBANA_API_KEY
capability:
  consumes:
  - type: http
    namespace: kibana-elastic-agent-actions
    baseUri: https://{kibana_url}
    description: Kibana APIs — Elastic Agent actions business capability. Self-contained, no shared references.
    resources:
    - name: api-fleet-agents-action_status
      path: /api/fleet/agents/action_status
      operations:
      - name: getfleetagentsactionstatus
        method: GET
        description: Get an agent action status
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: page
          in: query
          type: number
          description: Page number
        - name: perPage
          in: query
          type: number
          description: Number of results per page
        - name: date
          in: query
          type: string
          description: Return actions created before this date
        - name: latest
          in: query
          type: number
          description: Return only the latest N actions
        - name: errorSize
          in: query
          type: number
          description: Number of error details to include per action
    - name: api-fleet-agents-actions-actionId-cancel
      path: /api/fleet/agents/actions/{actionId}/cancel
      operations:
      - name: postfleetagentsactionsactionidcancel
        method: POST
        description: Cancel an agent action
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: actionId
          in: path
          type: string
          description: The ID of the action to cancel
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-bulk_reassign
      path: /api/fleet/agents/bulk_reassign
      operations:
      - name: postfleetagentsbulkreassign
        method: POST
        description: Bulk reassign agents
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-bulk_request_diagnostics
      path: /api/fleet/agents/bulk_request_diagnostics
      operations:
      - name: postfleetagentsbulkrequestdiagnostics
        method: POST
        description: Bulk request diagnostics from agents
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-bulk_rollback
      path: /api/fleet/agents/bulk_rollback
      operations:
      - name: postfleetagentsbulkrollback
        method: POST
        description: Bulk rollback agents
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-bulk_unenroll
      path: /api/fleet/agents/bulk_unenroll
      operations:
      - name: postfleetagentsbulkunenroll
        method: POST
        description: Bulk unenroll agents
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-bulk_update_agent_tags
      path: /api/fleet/agents/bulk_update_agent_tags
      operations:
      - name: postfleetagentsbulkupdateagenttags
        method: POST
        description: Bulk update agent tags
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-bulk_upgrade
      path: /api/fleet/agents/bulk_upgrade
      operations:
      - name: postfleetagentsbulkupgrade
        method: POST
        description: Bulk upgrade agents
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-agentId-actions
      path: /api/fleet/agents/{agentId}/actions
      operations:
      - name: postfleetagentsagentidactions
        method: POST
        description: Create an agent action
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: agentId
          in: path
          type: string
          description: The agent ID
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-agentId-reassign
      path: /api/fleet/agents/{agentId}/reassign
      operations:
      - name: postfleetagentsagentidreassign
        method: POST
        description: Reassign an agent
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: agentId
          in: path
          type: string
          description: The agent ID
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-agentId-request_diagnostics
      path: /api/fleet/agents/{agentId}/request_diagnostics
      operations:
      - name: postfleetagentsagentidrequestdiagnostics
        method: POST
        description: Request agent diagnostics
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: agentId
          in: path
          type: string
          description: The agent ID
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-agentId-rollback
      path: /api/fleet/agents/{agentId}/rollback
      operations:
      - name: postfleetagentsagentidrollback
        method: POST
        description: Rollback an agent
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: agentId
          in: path
          type: string
          description: The agent ID to rollback
          required: true
    - name: api-fleet-agents-agentId-unenroll
      path: /api/fleet/agents/{agentId}/unenroll
      operations:
      - name: postfleetagentsagentidunenroll
        method: POST
        description: Unenroll an agent
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: agentId
          in: path
          type: string
          description: The agent ID
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-agentId-upgrade
      path: /api/fleet/agents/{agentId}/upgrade
      operations:
      - name: postfleetagentsagentidupgrade
        method: POST
        description: Upgrade an agent
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: agentId
          in: path
          type: string
          description: The agent ID
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    authentication:
      type: apikey
      key: Authorization
      value: '{{env.KIBANA_API_KEY}}'
      placement: header
  exposes:
  - type: rest
    namespace: kibana-elastic-agent-actions-rest
    port: 8080
    description: REST adapter for Kibana APIs — Elastic Agent actions. One Spectral-compliant resource per consumed operation,
      prefixed with /v1.
    resources:
    - path: /v1/api/fleet/agents/action-status
      name: api-fleet-agents-action-status
      description: REST surface for api-fleet-agents-action_status.
      operations:
      - method: GET
        name: getfleetagentsactionstatus
        description: Get an agent action status
        call: kibana-elastic-agent-actions.getfleetagentsactionstatus
        with:
          page: rest.page
          perPage: rest.perPage
          date: rest.date
          latest: rest.latest
          errorSize: rest.errorSize
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/actions/{actionid}/cancel
      name: api-fleet-agents-actions-actionid-cancel
      description: REST surface for api-fleet-agents-actions-actionId-cancel.
      operations:
      - method: POST
        name: postfleetagentsactionsactionidcancel
        description: Cancel an agent action
        call: kibana-elastic-agent-actions.postfleetagentsactionsactionidcancel
        with:
          kbn-xsrf: rest.kbn-xsrf
          actionId: rest.actionId
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/bulk-reassign
      name: api-fleet-agents-bulk-reassign
      description: REST surface for api-fleet-agents-bulk_reassign.
      operations:
      - method: POST
        name: postfleetagentsbulkreassign
        description: Bulk reassign agents
        call: kibana-elastic-agent-actions.postfleetagentsbulkreassign
        with:
          kbn-xsrf: rest.kbn-xsrf
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/bulk-request-diagnostics
      name: api-fleet-agents-bulk-request-diagnostics
      description: REST surface for api-fleet-agents-bulk_request_diagnostics.
      operations:
      - method: POST
        name: postfleetagentsbulkrequestdiagnostics
        description: Bulk request diagnostics from agents
        call: kibana-elastic-agent-actions.postfleetagentsbulkrequestdiagnostics
        with:
          kbn-xsrf: rest.kbn-xsrf
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/bulk-rollback
      name: api-fleet-agents-bulk-rollback
      description: REST surface for api-fleet-agents-bulk_rollback.
      operations:
      - method: POST
        name: postfleetagentsbulkrollback
        description: Bulk rollback agents
        call: kibana-elastic-agent-actions.postfleetagentsbulkrollback
        with:
          kbn-xsrf: rest.kbn-xsrf
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/bulk-unenroll
      name: api-fleet-agents-bulk-unenroll
      description: REST surface for api-fleet-agents-bulk_unenroll.
      operations:
      - method: POST
        name: postfleetagentsbulkunenroll
        description: Bulk unenroll agents
        call: kibana-elastic-agent-actions.postfleetagentsbulkunenroll
        with:
          kbn-xsrf: rest.kbn-xsrf
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/bulk-update-agent-tags
      name: api-fleet-agents-bulk-update-agent-tags
      description: REST surface for api-fleet-agents-bulk_update_agent_tags.
      operations:
      - method: POST
        name: postfleetagentsbulkupdateagenttags
        description: Bulk update agent tags
        call: kibana-elastic-agent-actions.postfleetagentsbulkupdateagenttags
        with:
          kbn-xsrf: rest.kbn-xsrf
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/bulk-upgrade
      name: api-fleet-agents-bulk-upgrade
      description: REST surface for api-fleet-agents-bulk_upgrade.
      operations:
      - method: POST
        name: postfleetagentsbulkupgrade
        description: Bulk upgrade agents
        call: kibana-elastic-agent-actions.postfleetagentsbulkupgrade
        with:
          kbn-xsrf: rest.kbn-xsrf
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}/actions
      name: api-fleet-agents-agentid-actions
      description: REST surface for api-fleet-agents-agentId-actions.
      operations:
      - method: POST
        name: postfleetagentsagentidactions
        description: Create an agent action
        call: kibana-elastic-agent-actions.postfleetagentsagentidactions
        with:
          kbn-xsrf: rest.kbn-xsrf
          agentId: rest.agentId
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}/reassign
      name: api-fleet-agents-agentid-reassign
      description: REST surface for api-fleet-agents-agentId-reassign.
      operations:
      - method: POST
        name: postfleetagentsagentidreassign
        description: Reassign an agent
        call: kibana-elastic-agent-actions.postfleetagentsagentidreassign
        with:
          kbn-xsrf: rest.kbn-xsrf
          agentId: rest.agentId
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}/request-diagnostics
      name: api-fleet-agents-agentid-request-diagnostics
      description: REST surface for api-fleet-agents-agentId-request_diagnostics.
      operations:
      - method: POST
        name: postfleetagentsagentidrequestdiagnostics
        description: Request agent diagnostics
        call: kibana-elastic-agent-actions.postfleetagentsagentidrequestdiagnostics
        with:
          kbn-xsrf: rest.kbn-xsrf
          agentId: rest.agentId
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}/rollback
      name: api-fleet-agents-agentid-rollback
      description: REST surface for api-fleet-agents-agentId-rollback.
      operations:
      - method: POST
        name: postfleetagentsagentidrollback
        description: Rollback an agent
        call: kibana-elastic-agent-actions.postfleetagentsagentidrollback
        with:
          kbn-xsrf: rest.kbn-xsrf
          agentId: rest.agentId
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}/unenroll
      name: api-fleet-agents-agentid-unenroll
      description: REST surface for api-fleet-agents-agentId-unenroll.
      operations:
      - method: POST
        name: postfleetagentsagentidunenroll
        description: Unenroll an agent
        call: kibana-elastic-agent-actions.postfleetagentsagentidunenroll
        with:
          kbn-xsrf: rest.kbn-xsrf
          agentId: rest.agentId
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}/upgrade
      name: api-fleet-agents-agentid-upgrade
      description: REST surface for api-fleet-agents-agentId-upgrade.
      operations:
      - method: POST
        name: postfleetagentsagentidupgrade
        description: Upgrade an agent
        call: kibana-elastic-agent-actions.postfleetagentsagentidupgrade
        with:
          kbn-xsrf: rest.kbn-xsrf
          agentId: rest.agentId
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    namespace: kibana-elastic-agent-actions-mcp
    port: 9090
    transport: http
    description: MCP adapter for Kibana APIs — Elastic Agent actions. One tool per consumed operation, routed inline through
      this capability's consumes block.
    tools:
    - name: get-agent-action-status
      description: Get an agent action status
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: kibana-elastic-agent-actions.getfleetagentsactionstatus
      with:
        page: tools.page
        perPage: tools.perPage
        date: tools.date
        latest: tools.latest
        errorSize: tools.errorSize
      outputParameters:
      - type: object
        mapping: $.
    - name: cancel-agent-action
      description: Cancel an agent action
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsactionsactionidcancel
      with:
        kbn-xsrf: tools.kbn-xsrf
        actionId: tools.actionId
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: bulk-reassign-agents
      description: Bulk reassign agents
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsbulkreassign
      with:
        kbn-xsrf: tools.kbn-xsrf
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: bulk-request-diagnostics-agents
      description: Bulk request diagnostics from agents
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsbulkrequestdiagnostics
      with:
        kbn-xsrf: tools.kbn-xsrf
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: bulk-rollback-agents
      description: Bulk rollback agents
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsbulkrollback
      with:
        kbn-xsrf: tools.kbn-xsrf
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: bulk-unenroll-agents
      description: Bulk unenroll agents
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsbulkunenroll
      with:
        kbn-xsrf: tools.kbn-xsrf
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: bulk-update-agent-tags
      description: Bulk update agent tags
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsbulkupdateagenttags
      with:
        kbn-xsrf: tools.kbn-xsrf
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: bulk-upgrade-agents
      description: Bulk upgrade agents
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsbulkupgrade
      with:
        kbn-xsrf: tools.kbn-xsrf
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: create-agent-action
      description: Create an agent action
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsagentidactions
      with:
        kbn-xsrf: tools.kbn-xsrf
        agentId: tools.agentId
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: reassign-agent
      description: Reassign an agent
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsagentidreassign
      with:
        kbn-xsrf: tools.kbn-xsrf
        agentId: tools.agentId
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: request-agent-diagnostics
      description: Request agent diagnostics
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsagentidrequestdiagnostics
      with:
        kbn-xsrf: tools.kbn-xsrf
        agentId: tools.agentId
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: rollback-agent
      description: Rollback an agent
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsagentidrollback
      with:
        kbn-xsrf: tools.kbn-xsrf
        agentId: tools.agentId
      outputParameters:
      - type: object
        mapping: $.
    - name: unenroll-agent
      description: Unenroll an agent
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsagentidunenroll
      with:
        kbn-xsrf: tools.kbn-xsrf
        agentId: tools.agentId
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: upgrade-agent
      description: Upgrade an agent
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agent-actions.postfleetagentsagentidupgrade
      with:
        kbn-xsrf: tools.kbn-xsrf
        agentId: tools.agentId
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.