Kibana APIs — Elastic Agents

naftiko: 1.0.0-alpha2
info:
  label: Kibana APIs — Elastic Agents
  description: 'Kibana APIs — Elastic Agents. 18 operations. Lead operation: Get incoming agent data. Self-contained Naftiko
    capability covering one Kibana business surface.'
  tags:
  - Kibana
  - Elastic Agents
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    KIBANA_API_KEY: KIBANA_API_KEY
capability:
  consumes:
  - type: http
    namespace: kibana-elastic-agents
    baseUri: https://{kibana_url}
    description: Kibana APIs — Elastic Agents business capability. Self-contained, no shared references.
    resources:
    - name: api-fleet-agent_status-data
      path: /api/fleet/agent_status/data
      operations:
      - name: getfleetagentstatusdata
        method: GET
        description: Get incoming agent data
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: agentsIds
          in: query
          type: array
          description: Agent IDs to check data for, as an array or comma-separated string
          required: true
        - name: pkgName
          in: query
          type: string
          description: Filter by integration package name
        - name: pkgVersion
          in: query
          type: string
          description: Filter by integration package version
        - name: previewData
          in: query
          type: boolean
          description: When true, return a preview of the ingested data
    - name: api-fleet-agents
      path: /api/fleet/agents
      operations:
      - name: getfleetagents
        method: GET
        description: Get agents
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: page
          in: query
          type: number
          description: Page number
        - name: perPage
          in: query
          type: number
          description: Number of results per page
        - name: kuery
          in: query
          type: string
          description: A KQL query string to filter results
        - name: showAgentless
          in: query
          type: boolean
          description: When true, include agentless agents in the results
        - name: showInactive
          in: query
          type: boolean
          description: When true, include inactive agents in the results
        - name: withMetrics
          in: query
          type: boolean
          description: When true, include CPU and memory metrics in the response
        - name: showUpgradeable
          in: query
          type: boolean
          description: When true, only return agents that are upgradeable
        - name: getStatusSummary
          in: query
          type: boolean
          description: When true, return a summary of agent statuses in the response
        - name: sortField
          in: query
          type: string
          description: Field to sort results by
        - name: sortOrder
          in: query
          type: string
          description: Sort order, ascending or descending
        - name: searchAfter
          in: query
          type: string
          description: JSON-encoded array of sort values for `search_after` pagination
        - name: openPit
          in: query
          type: boolean
          description: When true, opens a new point-in-time for pagination
        - name: pitId
          in: query
          type: string
          description: Point-in-time ID for pagination
        - name: pitKeepAlive
          in: query
          type: string
          description: Duration to keep the point-in-time alive, for example, `1m`
      - name: postfleetagents
        method: POST
        description: Get agents by action ids
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-available_versions
      path: /api/fleet/agents/available_versions
      operations:
      - name: getfleetagentsavailableversions
        method: GET
        description: Get available agent versions
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-fleet-agents-bulk_migrate
      path: /api/fleet/agents/bulk_migrate
      operations:
      - name: postfleetagentsbulkmigrate
        method: POST
        description: Migrate multiple agents
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-bulk_privilege_level_change
      path: /api/fleet/agents/bulk_privilege_level_change
      operations:
      - name: postfleetagentsbulkprivilegelevelchange
        method: POST
        description: Bulk change agent privilege level
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-files-fileId
      path: /api/fleet/agents/files/{fileId}
      operations:
      - name: deletefleetagentsfilesfileid
        method: DELETE
        description: Delete an uploaded file
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: fileId
          in: path
          type: string
          description: The ID of the uploaded file
          required: true
    - name: api-fleet-agents-files-fileId-fileName
      path: /api/fleet/agents/files/{fileId}/{fileName}
      operations:
      - name: getfleetagentsfilesfileidfilename
        method: GET
        description: Get an uploaded file
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: fileId
          in: path
          type: string
          description: The ID of the uploaded file
          required: true
        - name: fileName
          in: path
          type: string
          description: The name of the uploaded file
          required: true
    - name: api-fleet-agents-setup
      path: /api/fleet/agents/setup
      operations:
      - name: getfleetagentssetup
        method: GET
        description: Get agent setup info
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: postfleetagentssetup
        method: POST
        description: Initiate Fleet setup
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
    - name: api-fleet-agents-tags
      path: /api/fleet/agents/tags
      operations:
      - name: getfleetagentstags
        method: GET
        description: Get agent tags
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kuery
          in: query
          type: string
          description: A KQL query string to filter results
        - name: showInactive
          in: query
          type: boolean
          description: When true, include tags from inactive agents
    - name: api-fleet-agents-agentId
      path: /api/fleet/agents/{agentId}
      operations:
      - name: deletefleetagentsagentid
        method: DELETE
        description: Delete an agent
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: agentId
          in: path
          type: string
          description: The agent ID
          required: true
      - name: getfleetagentsagentid
        method: GET
        description: Get an agent
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: agentId
          in: path
          type: string
          description: The agent ID
          required: true
        - name: withMetrics
          in: query
          type: boolean
          description: When true, include CPU and memory metrics in the response
      - name: putfleetagentsagentid
        method: PUT
        description: Update an agent by ID
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: agentId
          in: path
          type: string
          description: The agent ID
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-agentId-effective_config
      path: /api/fleet/agents/{agentId}/effective_config
      operations:
      - name: getfleetagentsagentideffectiveconfig
        method: GET
        description: Get an agent's effective config
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: agentId
          in: path
          type: string
          description: The agent ID to get effective config of
          required: true
    - name: api-fleet-agents-agentId-migrate
      path: /api/fleet/agents/{agentId}/migrate
      operations:
      - name: postfleetagentsagentidmigrate
        method: POST
        description: Migrate a single agent
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: agentId
          in: path
          type: string
          description: The agent ID
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-agentId-privilege_level_change
      path: /api/fleet/agents/{agentId}/privilege_level_change
      operations:
      - name: postfleetagentsagentidprivilegelevelchange
        method: POST
        description: Change agent privilege level
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: kbn-xsrf
          in: header
          type: string
          description: A required header to protect against CSRF attacks
          required: true
        - name: agentId
          in: path
          type: string
          description: The agent ID to change privilege level for
          required: true
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: api-fleet-agents-agentId-uploads
      path: /api/fleet/agents/{agentId}/uploads
      operations:
      - name: getfleetagentsagentiduploads
        method: GET
        description: Get agent uploads
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: agentId
          in: path
          type: string
          description: The agent ID
          required: true
    authentication:
      type: apikey
      key: Authorization
      value: '{{env.KIBANA_API_KEY}}'
      placement: header
  exposes:
  - type: rest
    namespace: kibana-elastic-agents-rest
    port: 8080
    description: REST adapter for Kibana APIs — Elastic Agents. One Spectral-compliant resource per consumed operation, prefixed
      with /v1.
    resources:
    - path: /v1/api/fleet/agent-status/data
      name: api-fleet-agent-status-data
      description: REST surface for api-fleet-agent_status-data.
      operations:
      - method: GET
        name: getfleetagentstatusdata
        description: Get incoming agent data
        call: kibana-elastic-agents.getfleetagentstatusdata
        with:
          agentsIds: rest.agentsIds
          pkgName: rest.pkgName
          pkgVersion: rest.pkgVersion
          previewData: rest.previewData
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents
      name: api-fleet-agents
      description: REST surface for api-fleet-agents.
      operations:
      - method: GET
        name: getfleetagents
        description: Get agents
        call: kibana-elastic-agents.getfleetagents
        with:
          page: rest.page
          perPage: rest.perPage
          kuery: rest.kuery
          showAgentless: rest.showAgentless
          showInactive: rest.showInactive
          withMetrics: rest.withMetrics
          showUpgradeable: rest.showUpgradeable
          getStatusSummary: rest.getStatusSummary
          sortField: rest.sortField
          sortOrder: rest.sortOrder
          searchAfter: rest.searchAfter
          openPit: rest.openPit
          pitId: rest.pitId
          pitKeepAlive: rest.pitKeepAlive
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: postfleetagents
        description: Get agents by action ids
        call: kibana-elastic-agents.postfleetagents
        with:
          kbn-xsrf: rest.kbn-xsrf
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/available-versions
      name: api-fleet-agents-available-versions
      description: REST surface for api-fleet-agents-available_versions.
      operations:
      - method: GET
        name: getfleetagentsavailableversions
        description: Get available agent versions
        call: kibana-elastic-agents.getfleetagentsavailableversions
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/bulk-migrate
      name: api-fleet-agents-bulk-migrate
      description: REST surface for api-fleet-agents-bulk_migrate.
      operations:
      - method: POST
        name: postfleetagentsbulkmigrate
        description: Migrate multiple agents
        call: kibana-elastic-agents.postfleetagentsbulkmigrate
        with:
          kbn-xsrf: rest.kbn-xsrf
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/bulk-privilege-level-change
      name: api-fleet-agents-bulk-privilege-level-change
      description: REST surface for api-fleet-agents-bulk_privilege_level_change.
      operations:
      - method: POST
        name: postfleetagentsbulkprivilegelevelchange
        description: Bulk change agent privilege level
        call: kibana-elastic-agents.postfleetagentsbulkprivilegelevelchange
        with:
          kbn-xsrf: rest.kbn-xsrf
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/files/{fileid}
      name: api-fleet-agents-files-fileid
      description: REST surface for api-fleet-agents-files-fileId.
      operations:
      - method: DELETE
        name: deletefleetagentsfilesfileid
        description: Delete an uploaded file
        call: kibana-elastic-agents.deletefleetagentsfilesfileid
        with:
          kbn-xsrf: rest.kbn-xsrf
          fileId: rest.fileId
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/files/{fileid}/{filename}
      name: api-fleet-agents-files-fileid-filename
      description: REST surface for api-fleet-agents-files-fileId-fileName.
      operations:
      - method: GET
        name: getfleetagentsfilesfileidfilename
        description: Get an uploaded file
        call: kibana-elastic-agents.getfleetagentsfilesfileidfilename
        with:
          fileId: rest.fileId
          fileName: rest.fileName
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/setup
      name: api-fleet-agents-setup
      description: REST surface for api-fleet-agents-setup.
      operations:
      - method: GET
        name: getfleetagentssetup
        description: Get agent setup info
        call: kibana-elastic-agents.getfleetagentssetup
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: postfleetagentssetup
        description: Initiate Fleet setup
        call: kibana-elastic-agents.postfleetagentssetup
        with:
          kbn-xsrf: rest.kbn-xsrf
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/tags
      name: api-fleet-agents-tags
      description: REST surface for api-fleet-agents-tags.
      operations:
      - method: GET
        name: getfleetagentstags
        description: Get agent tags
        call: kibana-elastic-agents.getfleetagentstags
        with:
          kuery: rest.kuery
          showInactive: rest.showInactive
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}
      name: api-fleet-agents-agentid
      description: REST surface for api-fleet-agents-agentId.
      operations:
      - method: DELETE
        name: deletefleetagentsagentid
        description: Delete an agent
        call: kibana-elastic-agents.deletefleetagentsagentid
        with:
          kbn-xsrf: rest.kbn-xsrf
          agentId: rest.agentId
        outputParameters:
        - type: object
          mapping: $.
      - method: GET
        name: getfleetagentsagentid
        description: Get an agent
        call: kibana-elastic-agents.getfleetagentsagentid
        with:
          agentId: rest.agentId
          withMetrics: rest.withMetrics
        outputParameters:
        - type: object
          mapping: $.
      - method: PUT
        name: putfleetagentsagentid
        description: Update an agent by ID
        call: kibana-elastic-agents.putfleetagentsagentid
        with:
          kbn-xsrf: rest.kbn-xsrf
          agentId: rest.agentId
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}/effective-config
      name: api-fleet-agents-agentid-effective-config
      description: REST surface for api-fleet-agents-agentId-effective_config.
      operations:
      - method: GET
        name: getfleetagentsagentideffectiveconfig
        description: Get an agent's effective config
        call: kibana-elastic-agents.getfleetagentsagentideffectiveconfig
        with:
          agentId: rest.agentId
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}/migrate
      name: api-fleet-agents-agentid-migrate
      description: REST surface for api-fleet-agents-agentId-migrate.
      operations:
      - method: POST
        name: postfleetagentsagentidmigrate
        description: Migrate a single agent
        call: kibana-elastic-agents.postfleetagentsagentidmigrate
        with:
          kbn-xsrf: rest.kbn-xsrf
          agentId: rest.agentId
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}/privilege-level-change
      name: api-fleet-agents-agentid-privilege-level-change
      description: REST surface for api-fleet-agents-agentId-privilege_level_change.
      operations:
      - method: POST
        name: postfleetagentsagentidprivilegelevelchange
        description: Change agent privilege level
        call: kibana-elastic-agents.postfleetagentsagentidprivilegelevelchange
        with:
          kbn-xsrf: rest.kbn-xsrf
          agentId: rest.agentId
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/fleet/agents/{agentid}/uploads
      name: api-fleet-agents-agentid-uploads
      description: REST surface for api-fleet-agents-agentId-uploads.
      operations:
      - method: GET
        name: getfleetagentsagentiduploads
        description: Get agent uploads
        call: kibana-elastic-agents.getfleetagentsagentiduploads
        with:
          agentId: rest.agentId
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    namespace: kibana-elastic-agents-mcp
    port: 9090
    transport: http
    description: MCP adapter for Kibana APIs — Elastic Agents. One tool per consumed operation, routed inline through this
      capability's consumes block.
    tools:
    - name: get-incoming-agent-data
      description: Get incoming agent data
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: kibana-elastic-agents.getfleetagentstatusdata
      with:
        agentsIds: tools.agentsIds
        pkgName: tools.pkgName
        pkgVersion: tools.pkgVersion
        previewData: tools.previewData
      outputParameters:
      - type: object
        mapping: $.
    - name: get-agents
      description: Get agents
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: kibana-elastic-agents.getfleetagents
      with:
        page: tools.page
        perPage: tools.perPage
        kuery: tools.kuery
        showAgentless: tools.showAgentless
        showInactive: tools.showInactive
        withMetrics: tools.withMetrics
        showUpgradeable: tools.showUpgradeable
        getStatusSummary: tools.getStatusSummary
        sortField: tools.sortField
        sortOrder: tools.sortOrder
        searchAfter: tools.searchAfter
        openPit: tools.openPit
        pitId: tools.pitId
        pitKeepAlive: tools.pitKeepAlive
      outputParameters:
      - type: object
        mapping: $.
    - name: get-agents-action-ids
      description: Get agents by action ids
      hints:
        readOnly: true
        destructive: false
        idempotent: false
      call: kibana-elastic-agents.postfleetagents
      with:
        kbn-xsrf: tools.kbn-xsrf
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: get-available-agent-versions
      description: Get available agent versions
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: kibana-elastic-agents.getfleetagentsavailableversions
      outputParameters:
      - type: object
        mapping: $.
    - name: migrate-multiple-agents
      description: Migrate multiple agents
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agents.postfleetagentsbulkmigrate
      with:
        kbn-xsrf: tools.kbn-xsrf
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: bulk-change-agent-privilege-level
      description: Bulk change agent privilege level
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agents.postfleetagentsbulkprivilegelevelchange
      with:
        kbn-xsrf: tools.kbn-xsrf
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: delete-uploaded-file
      description: Delete an uploaded file
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: kibana-elastic-agents.deletefleetagentsfilesfileid
      with:
        kbn-xsrf: tools.kbn-xsrf
        fileId: tools.fileId
      outputParameters:
      - type: object
        mapping: $.
    - name: get-uploaded-file
      description: Get an uploaded file
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: kibana-elastic-agents.getfleetagentsfilesfileidfilename
      with:
        fileId: tools.fileId
        fileName: tools.fileName
      outputParameters:
      - type: object
        mapping: $.
    - name: get-agent-setup-info
      description: Get agent setup info
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: kibana-elastic-agents.getfleetagentssetup
      outputParameters:
      - type: object
        mapping: $.
    - name: initiate-fleet-setup
      description: Initiate Fleet setup
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agents.postfleetagentssetup
      with:
        kbn-xsrf: tools.kbn-xsrf
      outputParameters:
      - type: object
        mapping: $.
    - name: get-agent-tags
      description: Get agent tags
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: kibana-elastic-agents.getfleetagentstags
      with:
        kuery: tools.kuery
        showInactive: tools.showInactive
      outputParameters:
      - type: object
        mapping: $.
    - name: delete-agent
      description: Delete an agent
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: kibana-elastic-agents.deletefleetagentsagentid
      with:
        kbn-xsrf: tools.kbn-xsrf
        agentId: tools.agentId
      outputParameters:
      - type: object
        mapping: $.
    - name: get-agent
      description: Get an agent
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: kibana-elastic-agents.getfleetagentsagentid
      with:
        agentId: tools.agentId
        withMetrics: tools.withMetrics
      outputParameters:
      - type: object
        mapping: $.
    - name: update-agent-id
      description: Update an agent by ID
      hints:
        readOnly: false
        destructive: false
        idempotent: true
      call: kibana-elastic-agents.putfleetagentsagentid
      with:
        kbn-xsrf: tools.kbn-xsrf
        agentId: tools.agentId
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: get-agent-s-effective-config
      description: Get an agent's effective config
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: kibana-elastic-agents.getfleetagentsagentideffectiveconfig
      with:
        agentId: tools.agentId
      outputParameters:
      - type: object
        mapping: $.
    - name: migrate-single-agent
      description: Migrate a single agent
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agents.postfleetagentsagentidmigrate
      with:
        kbn-xsrf: tools.kbn-xsrf
        agentId: tools.agentId
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: change-agent-privilege-level
      description: Change agent privilege level
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: kibana-elastic-agents.postfleetagentsagentidprivilegelevelchange
      with:
        kbn-xsrf: tools.kbn-xsrf
        agentId: tools.agentId
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: get-agent-uploads
      description: Get agent uploads
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: kibana-elastic-agents.getfleetagentsagentiduploads
      with:
        agentId: tools.agentId
      outputParameters:
      - type: object
        mapping: $.