Create cloud onboarding instance

Base URL
https://{kibana_url}
  • POST /api/fleet/cloud_onboarding_deployments
  • POST /s/{space_id}/api/fleet/cloud_onboarding_deployments
Auth

Create a new Fleet cloud onboarding instance.

Required privileges

Privileges fleet-agent-policies-all or integrations-all

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

agentPolicyIds string[] · max items: 1000

Agent policy IDs for agent_based existing-policy deploys. Provided on create so that a mid-deploy tab-close leaves a record that hydrates back into existing mode.

authMethod enum

Authentication method. Allowed values depend on the delivery mechanism:

  • managed_integration: identity_federation | static_keys
  • agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role
Values: identity_federation static_keys temporary_keys shared_credentials assume_role
connectorId string · min length: 1 · max length: 255

ID of the fleet-cloud-connector to associate with this deployment. Omit for static-keys deployments.

dataFormat enum

Data format: ecs or otel.

Values: ecs otel
dedicatedNamespaceTemplates boolean

Whether the global namespace uses dedicated index templates. Applied to the installed packages after a deployment. Absent means off.

description string · max length: 2048

Integration description from the Service settings step.

globalRegion string · max length: 64

Global AWS region from the Service Settings step.

integrationName string · max length: 160

Integration name as entered in the Service settings step, before any per-package suffix is applied.

mechanisms enum[] · max items: 10 required

Delivery mechanisms active in this deployment.

Values: managed_integration ecf agent_based
namespace string · max length: 100

Global data stream namespace from the Service settings step. When omitted, an agent-based deployment inherits the agent policy namespace, other deployment methods use the default namespace.

packageNames string[] · max items: 100

Names of the integration packages this deployment covers (e.g. aws, aws_bedrock). Used to list the deployments of a package.

policySettings map string to string

Integration policy settings from the Service settings step that apply to every integration policy of the deployment, keyed by integration policy field (for example output_id).

<string> string · max length: 1024 · default: null
provider enum required

Cloud provider.

Values: aws azure gcp
serviceNames map string to string

Display name of each service as shown in the onboarding flow, by service ID.

<string> string · max length: 256
services string[] · min items: 1 · max items: 1000 required

Service IDs to be covered by this deployment.

serviceVars map string to string to object

Per-service config keyed by instance ID.

Responses

Successful response

application/json
item object required
agentPolicyIds string[] · max items: 1000

Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies.

apiKeyId string

Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.

attemptCount number · min: 1 required

Number of deployment attempts, including the current one.

authMethod enum

Authentication method. Allowed values depend on the delivery mechanism:

  • managed_integration: identity_federation | static_keys
  • agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role
Values: identity_federation static_keys temporary_keys shared_credentials assume_role
connectorId string

ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.

dataFormat enum

Data format: ecs or otel.

Values: ecs otel
dedicatedNamespaceTemplates boolean

Whether the global namespace uses dedicated index templates. Applied to the installed packages after a deployment. Absent means off.

deploymentId string

Opaque deployment identifier; for AWS, the CFN stack ARN.

deploymentName string

Opaque deployment name; for AWS, the CFN stack name.

description string

Integration description from the Service settings step.

globalRegion string

Global AWS region from the Service Settings step.

id string required
integrationName string

Integration name as entered in the Service settings step, before any per-package suffix is applied.

mechanisms enum[] · max items: 10 required
Values: managed_integration ecf agent_based
namespace string

Global data stream namespace from the Service settings step. When omitted, an agent-based deployment inherits the agent policy namespace, other deployment methods use the default namespace.

packageNames string[] · max items: 100

Names of the integration packages this deployment covers (e.g. aws, aws_bedrock). Used to list the deployments of a package.

packagePolicyIds string[] · max items: 1000

Integration policy IDs created for this deployment (managed_integration and agent_based).

policyIdsByInstance map string to string

instanceId → policyId mapping persisted after deploy. Hydrated into the wizard on resume to enable cleanup of stale policies when services are removed.

<string> string · max length: 255
policySettings map string to string

Integration policy settings from the Service settings step that apply to every integration policy of the deployment, keyed by integration policy field (for example output_id).

<string> string · max length: 1024 · default: null
provider enum required

Cloud provider.

Values: aws azure gcp
serviceNames map string to string

Display name of each service as shown in the onboarding flow, by service ID.

<string> string · max length: 256
services string[] · max items: 1000 required

Service IDs covered by this deployment.

serviceVars map string to string to object

Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.

status enum required

Deployment status.

Values: pending deploying succeeded failed
statusMessage string

Error context when status is failed.

updatedAt string

ISO timestamp of the last write.

updatedBy string

Username of the user who last wrote the deployment.

Base URL
https://{kibana_url}